# OpenCode MCP OAuth Remote Code Execution (Windows/WSL) - Silently Patched in 1.18.33, No CVE

> Pillar Security (Eilon Cohen) reports a critical RCE in OpenCode, the open-source AI coding agent from Anomaly: a malicious remote MCP server can run arbitrary code on a developer's Windows or WSL machine during MCP OAuth authentication, with no further user interaction. Versions 1.0.137 to 1.18.32 are affected; 1.18.33 (2026-09-28) fixed it without a CVE or security advisory.

- **Published:** 2026-10-21T00:11:37Z
- **Last reviewed:** 2026-10-21T00:11:37Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3993
- **ID:** TL-2026-3993
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-61591

## Description

OpenCode (npm package opencode-ai, repository anomalyco/opencode) supports remote Model Context Protocol (MCP) servers that use OAuth. During OAuth discovery, the remote server returns a WWW-Authenticate challenge / discovery document containing an authorization_endpoint value. In affected releases this untrusted, server-controlled value flows without validation through the MCP SDK, oauth-provider.ts, mcp/index.ts and browser.ts into the open() browser launcher.

The launcher is the npm package 'open' (version 10.1.2 pinned by affected OpenCode releases). On Windows (and WSL, which shells out to PowerShell) it builds a PowerShell command in which the application name is escaped but options.target (the URL) is placed inside double quotes unescaped, then base64-encodes the command for 'powershell -EncodedCommand'. PowerShell expands $(...) subexpressions inside double-quoted strings, so a well-formed HTTPS URL such as https://evil.test/$([IO.File]::WriteAllText('C:\Users\Public\pwned.txt','RCE')) executes attacker-chosen PowerShell as the developer's user when OpenCode opens the browser to authenticate. Because the payload is an ordinary https URL, scheme allowlists/denylists (http/https only, or blocking javascript:/data:/vbscript:) do not stop it.

This is the same sink class as CVE-2025-6514 (mcp-remote), CVE-2025-58062 (openmcp-client) and CVE-2025-10619 (sequa-mcp), per Pillar. The underlying 'open' escaping problem was reported in sindresorhus/open issue #202 (2020) and issue #323 (2023-10-18, PoC open('https://$(calc.exe)')); #323 was closed as not planned on 2025-11-12 and an escaping fix shipped in open@11.0.0 (Nov 2025).

Disclosure and remediation: Pillar reported privately through a GitHub Security Advisory on 2026-08-29 with reproduction material. Anomaly declined a CVE request, treating malicious remote MCP connections as outside its threat model, and merged PR #51414 (commit 29f07e0c) on 2026-09-25. Release 1.18.33 (2026-09-28) upgrades 'open' to 11.0.4 (wraps the target in single quotes), adds openUrl() validation rejecting non-http(s) schemes, and adds scheme checks in redirectToAuthorization. The fix shipped as a browser-launch refactor with no advisory or release-note mention, so dependency scanners and advisory feeds do not flag affected installs. Pillar judged the scheme validation alone insufficient; the single-quote wrapping in open@11.0.4 is the effective control.

Source-date note: Pillar's post states public disclosure on 2026-10-04, while the Infosecurity Magazine article (2026-10-20) and platform hunt data place the Pillar report at 2026-10-19. No in-the-wild exploitation is reported in any source; ACTIVE status reflects the unpatched population and absence of an advisory. The CVSS 9.8 score is as reported by the source; no vector string was published. No network IOCs were published; evil.test in the PoC is a placeholder.

## MITRE ATT&CK

- T1608 Stage Capabilities
- T1203 Exploitation for Client Execution
- T1059.001 PowerShell
- T1027 Obfuscated Files or Information
- T1071.001 Web Protocols

## Sources

- [Researchers Warn OpenCode Quietly Patched Critical RCE Flaw, Leaving Users At Risk](https://www.infosecurity-magazine.com/news/opencode-quietly-patched-critical/)
- [Open and Shut: Remote Code Execution in OpenCode via MCP OAuth (Pillar Security)](https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth)
- [OpenCode fix PR #51414 (commit 29f07e0c)](https://github.com/anomalyco/opencode/pull/51414)
- [OpenCode repository](https://github.com/anomalyco/opencode)
- [sindresorhus/open issue #323: OS command injection on windows when opening urls](https://github.com/sindresorhus/open/issues/323)
- [sindresorhus/open repository](https://github.com/sindresorhus/open)
- [CVE-2025-61591 - Cursor CLI MCP OAuth command injection (related class)](https://cvefeed.io/vuln/detail/CVE-2025-61591)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3993