The Pulse
Pillar Finds Remote Code Execution Flaw in OpenCode’s MCP OAuth
Pillar Security says a malicious remote MCP server could exploit an OAuth discovery flow to run commands on affected OpenCode installations for Windows and WSL. The report says the flaw was fixed in version 1.18.33 before Pillar published i
AI.info Team · Written with AI · fact-checked ·
On October 4, 2026, Pillar Security published a report on a remote-code-execution flaw in OpenCode, an AI coding agent, that could let a hostile remote MCP server run commands on a developer’s Windows machine. The attack travels through OAuth discovery: metadata supplied by the server reaches OpenCode’s browser-launching code, which invokes PowerShell. Pillar says the vulnerability affects OpenCode versions 1.0.137 through 1.18.32 on Windows and Windows Subsystem for Linux (WSL).
“The attack does not require installing malicious software, exploiting the AI model or tricking it through prompt injection.”
Eilon Cohen, report author
OAuth discovery feeds a server-controlled URL to PowerShell
During authentication, a remote Model Context Protocol server can answer with a 401 response and a WWW-Authenticate challenge directing the client to discovery documents. Those documents supply an authorization_endpoint—a URL chosen by the server. In OpenCode 1.18.32, Pillar found, that value passed through the MCP software development kit and the agent’s OAuth and browser code before reaching the open package.
The vulnerable Windows path used open@10.1.2, which passed the target URL to PowerShell inside a double-quoted string. PowerShell evaluates $(...) expressions inside double quotes, so a crafted URL could cause a command to run as part of the browser launch. Pillar says the command could execute even if the browser subsequently failed to open, and OpenCode discarded that launch error.
The attack does not depend on a developer approving a tool call or following a prompt-injection instruction, according to Pillar. A server could also become hostile after it was first configured: the malicious response arrives when the client connects and starts the OAuth process. Since OpenCode runs with the developer’s privileges, successful execution can act with those same privileges.
HTTPS checks did not stop the payload
URL scheme filtering might appear to address the risk, but Pillar says its test URL used ordinary HTTPS. The MCP TypeScript SDK’s denylist blocks schemes such as javascript:, data: and vbscript:; an HTTPS address passes that check. Pillar also says the scheme check added in OpenCode 1.18.33 would not, by itself, reject the payload.
The fix that closed the vulnerable path was an update to open@11.0.4, which wraps the target in single quotes rather than double quotes. PowerShell does not expand expressions inside single-quoted strings. Pillar’s finding is a reminder that validating a URL’s scheme does not make it safe to interpolate the full URL into a shell command.
The report places the flaw in a class of command-injection issues previously documented in three 2025 CVEs: CVE-2025-6514, CVE-2025-58062 and CVE-2025-10619. Pillar says the vulnerable OpenCode code was written in December 2025, after those disclosures. It recommends that MCP clients pass remote values as arguments rather than construct shell commands from them.
The fix shipped before Pillar’s disclosure
Anomaly, OpenCode’s developer, released version 1.18.33 on September 28, according to Pillar, after receiving the researchers’ report. Pillar says the release included the dependency update, but Anomaly did not publish a security advisory or request a CVE for this issue. The researchers assign a proposed CVSS 3.1 score of 9.8; that is their assessment, not a published CVE rating.
Pillar quotes Anomaly’s response to the report as follows:
“we've updated the dependency, but generally, trying to deal with a malicious MCP server is outside our threat model.”
Anomaly, as quoted in Pillar Security’s report
Pillar says Anomaly considered malicious remote MCP servers outside its threat model. That position matters for anyone using a remote server: a configuration can point to a service that later changes, while an automated OAuth handshake processes its response. The report says macOS and Linux are not affected by this particular execution path because their browser launchers do not pass the URL through a shell.
Windows and WSL users need to check versions directly
Pillar warns that without a CVE for this finding, conventional vulnerability scanners and dependency alerts may not flag affected OpenCode installations. Teams should check versions themselves, focusing on Windows and WSL hosts that have remote MCP servers configured. The report lists OpenCode 1.18.33 or later as patched and advises removing unvetted remote MCP servers if an upgrade is not possible.
OpenCode had approximately 3 million weekly npm downloads and 211,000 GitHub stars at the time of Pillar’s report. For affected users, the immediate step is specific: verify the installed version, then upgrade to at least 1.18.33.