A significant vulnerability in the OpenCodeAI coding agent has been discovered, allowing malicious MCP servers to execute unauthorized code on developers' Windows and Windows Subsystem for Linux (WSL) machines during the sign-in process. This flaw, identified by Pillar Security, was disclosed on October 19 and affects OpenCode versions from 1.0.137 to 1.18.32. The risk arises when OpenCode connects to Model Context Protocol (MCP) servers to integrate external tools. During sign-in, the server provides a web address, an OAuth authorization endpoint, which is opened in a browser through a PowerShell command. The flaw occurs because this command is not properly escaped, enabling an attacker to execute arbitrary commands if they control or hijack an MCP server.

Anomaly, the company behind OpenCode, addressed the issue with version 1.18.33 on September 28 but did not issue a CVE or a security advisory. As a result, vulnerability scanners do not detect this flaw, making it vital for developers to manually verify their OpenCode version. Pillar Security rated the vulnerability as critical, with a severity score of 9.8 out of 10. Notably, macOS and Linux systems remain unaffected, as OpenCode opens the browser without involving a shell on these platforms.

The flaw was corrected by refactoring the browser-launch code, which is not explicitly documented as a security fix in the release notes. Anomaly's security policy indicates that MCP servers configured by users are outside their trust boundary, which influenced their decision not to request a CVE. This decision leaves it up to developers to ensure their systems are running the updated version of OpenCode. Although there are no reported instances of this vulnerability being exploited, developers should be vigilant and review their server configurations. This issue is distinct from a recent breach of OpenCode's hosted Console, which may have compromised some users' API keys.