---
title: opencode on Windows/WSL: a remote MCP server could run code on your machine during the OAuth login step (1.0.137 to 1.18.32; fixed silently in 1.18.33) | ctxsec
url: https://ctxsec.com/items/opencode-mcp-oauth-rce-windows-pillar
description: ""
status: "confirmed (Pillar Security research; fix in opencode 1.18.33 release); no CVE or vendor advisory"
published: 2026-10-19
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/opencode-mcp-oauth-rce-windows-pillar.md)

confirmed (Pillar Security research; fix in opencode 1.18.33 release); no CVE or vendor advisory

2026-10-19

### opencode on Windows/WSL: a remote MCP server could run code on your machine during the OAuth login step (1.0.137 to 1.18.32; fixed silently in 1.18.33)

Pillar Security says opencode, the open-source coding agent, passed the `authorization_endpoint` URL that a remote MCP server returns during OAuth discovery straight to the `open` npm package. On Windows and WSL that goes through PowerShell, so an ordinary-looking https:// URL with `$(...)` inside ran attacker commands on the developer's machine. No prompt injection, no install and no extra click were needed; just connecting to the server was enough. Checking the URL scheme doesn't stop it. The server doesn't have to be malicious when you add it: a later compromise, a hijacked registry entry, a typosquat or an expired domain could deliver the same payload. Pillar says the same bug class, in the same package and OAuth field, was CVE-2025-6514 (9.6) in July 2025. Affected versions are 1.0.137 through 1.18.32 on Windows and WSL; macOS and Linux are not affected. The fix shipped in 1.18.33 on Sep 28, 2026. Pillar says opencode's developer, Anomaly, shipped it as a refactor without an advisory or CVE, saying malicious remote MCP servers are outside its threat model, so scanners and dependency bots won't flag old installs. Pillar's proposed CVSS is 9.8. **What to do:** run `opencode --version` on Windows and WSL machines and upgrade anything below 1.18.33. Inventory installs directly rather than relying on CVE scanners, and treat every field a remote MCP server sends as untrusted input.

Sources: [Pillar Security: Open and Shut (opencode MCP OAuth RCE)](https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth) · [opencode v1.18.33 release (Sep 28)](https://github.com/anomalyco/opencode/releases/tag/v1.18.33) · [Santhosh Patel summary (X)](https://x.com/santhosh_patell/status/2112042968047600080)