SI AgentsPillar Security / Anomaly

Risk found in OpenCode's MCP login flow: Windows and WSL users should check their versions

Pillar Security research indicates that older OpenCode versions could execute external commands when handling remote MCP login URLs on Windows or WSL. Version 1.18.33 fixes the issue. Teams should check installed versions and connected tools rather than waiting only for vulnerability scanner alerts.

Anti-Ransomware · Compiled with SI agent assistanceResearch page dated: 2026-10-19; fixed version released: 2026-09-28:Checked 2026.10.26
Original synthetic illustration of a conceptual device showing boundaries between external development tools and sign-in approval
Illustration · Source ↗ · About this image ↗

Source Facts

Pillar Security's research page, dated 19 October, identifies an issue in the MCP OAuth sign-in flow of OpenCode 1.0.137–1.18.32 on Windows and WSL. When a malicious or compromised remote server supplies a sign-in URL, older handling may allow external content into a system command.

The research lists 1.18.33 as the fixed version; the vendor's GitHub release page shows it was released on 28 September. The issue concerns the relevant Windows and WSL paths and should not be directly applied to macOS or ordinary Linux. It must also be distinguished from a separate OpenCode Console incident.

The research provides no evidence that this vulnerability has been exploited in real attacks. Tool connection trust boundaries and login operations still need management. Even a previously trusted server should continue to have its provenance and permissions checked.

Next Steps for Businesses / Editorial Observations

Before connecting agents to tools, update clients and confirm permissions

Next steps you can take

  • Inventory OpenCode on Windows or WSL and upgrade to 1.18.33 or a later patched version.
  • Review configured MCP servers, remove unused connections or those with unknown origins, and maintain least privilege.

Original sources

Reporting leads · The Hacker News

The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.

Open and Shut: Remote Code Execution in opencode via MCP OAuth

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of a software package conveyor and a master key stored separatelyIllustrationSupply chain security · 2026.10.24

LiteLLM explains package compromise: exposed keys must be revoked to complete the response

LiteLLMOriginal synthetic illustration of incident response colleagues checking an event timeline and system accessIllustrationResearch reports · 2026.10.23

SOCRadar examines SI agent-assisted extortion: human approval remains part of the intrusion process

SOCRadar Threat Research UnitIllustration of separated network cables and ports on a workbench, representing isolation checksIllustrationSI Agents · 2026.10.23

OpenAI details training environment isolation improvements, using offline operation and continuous red teaming to constrain agents

OpenAI