OpenCode: Malicious MCP servers can execute PowerShell commands during OAuth sign-in on Windows/WSL (no CVE assigned)
Severity: critical · Patch status: patched · Since 2026-10-19 · CVE-2025-6514
A command-injection flaw in OpenCode's browser-launch helper let a malicious or later-hijacked remote MCP server supply an OAuth authorization endpoint that was passed unescaped into a PowerShell command, executing attacker code with the developer's privileges when the developer ran 'opencode mcp auth' on Windows or WSL. macOS and Linux are unaffected. Pillar Security disclosed it on October 19 after private reporting on August 29; Anomaly fixed it in 1.18.33 (September 28) as an unannounced refactor, declined a CVE on the grounds that user-configured MCP servers are outside its trust model, so scanners won't flag vulnerable builds. The underlying 'open' npm package fixed similar behavior in v11 in 2023. No in-the-wild exploitation reported. Separate from the OpenCode Console breach that may have exposed API keys.
What to do
- Upgrade OpenCode to 1.18.33 or later on all Windows and WSL machines
- Run 'opencode mcp list' and remove any unvetted remote MCP servers from configuration
- Audit remaining MCP servers for trustworthiness, including domains that could change hands
- Check OpenCode versions directly since no CVE exists for scanner detection
- Rotate API keys if potentially exposed via the related OpenCode Console breach
Fixed versions
Sources
All live incidents on Threat Watch
