Is opencode patched against the MCP OAuth command injection?

Anomaly fixed the flaw in opencode 1.18.33, published on 2026-09-28, by bumping the open dependency from 10.1.2 to 11.0.4 and routing browser launches through a shared opener that accepts only http and https URLs. Pillar Security says the dependency bump is what actually closes the hole, because the scheme check alone would not block the payload.

Am I affected if I run opencode on macOS or Linux?

macOS and Linux installs of opencode are not affected, according to Pillar Security's FAQ. The flaw depends on the open package building a PowerShell command string on Windows, where $(...) inside double quotes is expanded as code. Windows and WSL users running opencode-ai 1.0.137 through 1.18.32 are the exposed group.

Why is there no CVE for the opencode MCP OAuth flaw?

Anomaly did not publish a security advisory or request a CVE after Pillar Security asked for one, taking the position that a malicious MCP server sits outside the product's threat model. Pillar Security warns that without a CVE, dependency scanners and vulnerability feeds will not flag affected installs, so teams need to check opencode versions themselves.

MEDVulnerability

opencode: a remote MCP server could run commands on Windows

opencode ran attacker code on Windows when it connected to a malicious remote MCP server, fixed in version 1.18.33.

October 19, 2026 · Pillar Security · Research by Eilon Cohen

opencode

MEDVulnerability

opencode ran attacker-supplied commands on Windows when a remote MCP server returned a crafted OAuth authorization endpoint. Anomaly fixed the flaw in 1.18.33 without a CVE, so scanners will not flag older installs.

01What happened

Pillar Security disclosed a command injection flaw in opencode, the open-source coding agent built by Anomaly. Researcher Eilon Cohen reported it privately on 2026-08-29 and published the write-up on 2026-10-19. Anomaly shipped the fix in version 1.18.33 on 2026-09-28 as a refactor, with no security advisory and no CVE.

02How it works

A remote MCP server controls its own OAuth discovery document, and opencode passed that document's authorization_endpoint value straight to the open() browser launcher. On Windows, open built a PowerShell command string without escaping the URL, and PowerShell expands $(...) inside double quotes. A URL such as https://evil.test/$(...) therefore ran as code, even though the browser launch itself then failed.

03Who is affected

Windows and WSL users of opencode-ai from 1.0.137 through 1.18.32 are exposed, and only when they add a remote MCP server an attacker controls. macOS and Linux installs are not affected, per Pillar Security's FAQ.

04What to do

Upgrade opencode to 1.18.33 or later. On Windows or WSL installs that cannot upgrade, remove remote MCP servers you have not vetted. Inventory opencode installs by hand, because no CVE was assigned and dependency scanners will not flag the old versions.

Questions people ask

Is opencode patched against the MCP OAuth command injection?: Anomaly fixed the flaw in opencode 1.18.33, published on 2026-09-28, by bumping the open dependency from 10.1.2 to 11.0.4 and routing browser launches through a shared opener that accepts only http and https URLs. Pillar Security says the dependency bump is what actually closes the hole, because the scheme check alone would not block the payload.
Am I affected if I run opencode on macOS or Linux?: macOS and Linux installs of opencode are not affected, according to Pillar Security's FAQ. The flaw depends on the open package building a PowerShell command string on Windows, where $(...) inside double quotes is expanded as code. Windows and WSL users running opencode-ai 1.0.137 through 1.18.32 are the exposed group.
Why is there no CVE for the opencode MCP OAuth flaw?: Anomaly did not publish a security advisory or request a CVE after Pillar Security asked for one, taking the position that a malicious MCP server sits outside the product's threat model. Pillar Security warns that without a CVE, dependency scanners and vulnerability feeds will not flag affected installs, so teams need to check opencode versions themselves.

Sources 3 links, all fetched

1pillar.securityPillar Security Report
2github.comFix Pull Request
3github.comRelease 1.18.33