Threat reportVulnerabilityTL-2026-3993
OpenCode MCP OAuth Remote Code Execution (Windows/WSL) - Silently Patched in 1.18.33, No CVE
OpenCode MCP OAuth Remote Code Execution (Windows/WSL) (TL-2026-3993), also tracked as OpenCode MCP OAuth RCE, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-21. It has no confirmed attribution, affects Anomaly OpenCode (opencode-ai) on Windows and WSL, references 1 CVE (CVE-2025-61591), maps to 5 MITRE ATT&CK techniques (T1027, T1059.001, T1071.001), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3993
- Threat ID
- TL-2026-3993
- Also known as
- OpenCode MCP OAuth RCE, Open and Shut
- Severity
- CRITICAL
- CVSS
- 9.8
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in OpenCode MCP OAuth Remote Code Execution (Windows/WSL)
Malware and tooling: OpenCode
How OpenCode MCP OAuth Remote Code Execution (Windows/WSL) works
Pillar Security (Eilon Cohen) reports a critical RCE in OpenCode, the open-source AI coding agent from Anomaly: a malicious remote MCP server can run arbitrary code on a developer's Windows or WSL machine during MCP OAuth authentication, with no further user interaction. Versions 1.0.137 to 1.18.32 are affected; 1.18.33 (2026-09-28) fixed it without a CVE or security advisory.
OpenCode (npm package opencode-ai, repository anomalyco/opencode) supports remote Model Context Protocol (MCP) servers that use OAuth. During OAuth discovery, the remote server returns a WWW-Authenticate challenge / discovery document containing an authorization_endpoint value. In affected releases this untrusted, server-controlled value flows without validation through the MCP SDK, oauth-provider.ts, mcp/index.ts and browser.ts into the open() browser launcher.
The launcher is the npm package 'open' (version 10.1.2 pinned by affected OpenCode releases). On Windows (and WSL, which shells out to PowerShell) it builds a PowerShell command in which the application name is escaped but options.target (the URL) is placed inside double quotes unescaped, then base64-encodes the command for 'powershell -EncodedCommand'. PowerShell expands $(...) subexpressions inside double-quoted strings, so a well-formed HTTPS URL such as https://evil.test/$([IO.File]::WriteAllText('C:\Users\Public\pwned.txt','RCE')) executes attacker-chosen PowerShell as the developer's user when OpenCode opens the browser to authenticate. Because the payload is an ordinary https URL, scheme allowlists/denylists (http/https only, or blocking javascript:/data:/vbscript:) do not stop it.
This is the same sink class as CVE-2025-6514 (mcp-remote), CVE-2025-58062 (openmcp-client) and CVE-2025-10619 (sequa-mcp), per Pillar. The underlying 'open' escaping problem was reported in sindresorhus/open issue #202 (2020) and issue #323 (2023-10-18, PoC open('https://$(calc.exe)')); #323 was closed as not planned on 2025-11-12 and an escaping fix shipped in open@11.0.0 (Nov 2025).
Disclosure and remediation: Pillar reported privately through a GitHub Security Advisory on 2026-08-29 with reproduction material. Anomaly declined a CVE request, treating malicious remote MCP connections as outside its threat model, and merged PR #51414 (commit 29f07e0c) on 2026-09-25. Release 1.18.33 (2026-09-28) upgrades 'open' to 11.0.4 (wraps the target in single quotes), adds openUrl() validation rejecting non-http(s) schemes, and adds scheme checks in redirectToAuthorization. The fix shipped as a browser-launch refactor with no advisory or release-note mention, so dependency scanners and advisory feeds do not flag affected installs. Pillar judged the scheme validation alone insufficient; the single-quote wrapping in open@11.0.4 is the effective control.
Source-date note: Pillar's post states public disclosure on 2026-10-04, while the Infosecurity Magazine article (2026-10-20) and platform hunt data place the Pillar report at 2026-10-19. No in-the-wild exploitation is reported in any source; ACTIVE status reflects the unpatched population and absence of an advisory. The CVSS 9.8 score is as reported by the source; no vector string was published. No network IOCs were published; evil.test in the PoC is a placeholder.
MITRE ATT&CK techniques used in TL-2026-3993
Defense Evasion
T1027 Obfuscated Files or Information
Execution
T1059.001 PowerShell; T1203 Exploitation for Client Execution
Command and Control
Resource Development
Affected products and versions in OpenCode MCP OAuth Remote Code Execution (Windows/WSL)
- Anomaly — OpenCode (opencode-ai) on Windows and WSL
Vulnerable versions: 1.0.137 through 1.18.32
Fixed in: 1.18.33 - sindresorhus — open (npm) - Windows PowerShell URL escaping
Vulnerable versions: 10.1.2 (as pinned by affected OpenCode releases)
Fixed in: 11.0.4 (used by the OpenCode fix)
Remediation for OpenCode MCP OAuth Remote Code Execution (Windows/WSL)
Patches
- opencode 1.18.33 (2026-09-28): open dependency upgraded to 11.0.4, openUrl() and redirectToAuthorization scheme checks (PR #51414, commit 29f07e0c)
Immediate actions
- Upgrade opencode / opencode-ai to 1.18.33 or later on all Windows and WSL developer hosts
- Remove or disable unvetted remote MCP servers from OpenCode configuration until patched
- Inventory developer endpoints for opencode-ai versions 1.0.137 through 1.18.32, since scanners and dependency alerts will not flag them
Workarounds
- Do not authenticate to untrusted remote MCP servers over OAuth from Windows/WSL on affected versions
Longer-term hardening
- Only connect AI coding agents to MCP servers from vetted, allow-listed origins
- Treat every server-controlled field in MCP OAuth discovery (authorization_endpoint etc.) as untrusted input
- When building MCP clients, pass URLs to the OS via argument-vector process execution rather than shell string interpolation, and bind OAuth discovery to the configured origin
- Monitor for PowerShell -EncodedCommand launched from node/opencode processes
CVEs associated with OpenCode MCP OAuth Remote Code Execution (Windows/WSL)
Weaknesses (CWE) in OpenCode MCP OAuth Remote Code Execution (Windows/WSL)
Timeline of OpenCode MCP OAuth Remote Code Execution (Windows/WSL)
- Adobe engineer tripodsan reports OS command injection in the 'open' npm package on Windows (issue #323, PoC open('https://$(calc.exe)')); maintainer points to the README's no-security-guarantees statement
- Issue #323 closed as not planned; PowerShell escaping fix lands in open@11.0.0 in November 2025
- Pillar Security privately reports the OpenCode MCP OAuth RCE to Anomaly via GitHub Security Advisory with reproduction material
- Anomaly declines a CVE request (outside its threat model) and merges PR #51414 (commit 29f07e0c)
- OpenCode 1.18.33 published to npm: open upgraded to 11.0.4 and http(s) scheme checks added; no CVE, advisory or release-note mention
- Pillar's post states public disclosure on this date (other sources date the report 2026-10-19)
- Pillar Security report 'Open and Shut' published per platform hunt data and press coverage
- Infosecurity Magazine reports OpenCode quietly patched the critical RCE, leaving users at risk
Sources cited for OpenCode MCP OAuth Remote Code Execution (Windows/WSL)
- Researchers Warn OpenCode Quietly Patched Critical RCE Flaw, Leaving Users At Risk
- Open and Shut: Remote Code Execution in OpenCode via MCP OAuth (Pillar Security)
- OpenCode fix PR #51414 (commit 29f07e0c)
- OpenCode repository
- sindresorhus/open issue #323: OS command injection on windows when opening urls
- sindresorhus/open repository
- CVE-2025-61591 - Cursor CLI MCP OAuth command injection (related class)
Detection coverage for TL-2026-3993
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3993 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.