Pillar Security Warns OpenCode Users of Silently Patched Critical RCE Flaw
Researchers say a critical remote code execution vulnerability in OpenCode was fixed without a CVE, leaving many users unaware of the risk.
Key points
- Pillar Security disclosed a critical RCE flaw in OpenCode versions 1.0.137 to 1.18.32 on October 19.
- Anomaly patched the issue in version 1.18.33 on September 28 without issuing a CVE or security advisory.
- The vulnerability allows arbitrary code execution on Windows and WSL via malicious MCP servers during OAuth.
Security researchers at Pillar Security warned on October 19 that a critical remote code execution vulnerability in the open-source AI coding tool OpenCode was patched silently. This lack of disclosure means users running vulnerable versions may remain unaware of the significant security risk to their systems.
The flaw affects OpenCode versions 1.0.137 through 1.18.32. According to Eilon Cohen, head of security research at Pillar Security, an attacker-controlled remote model context protocol (MCP) server could execute arbitrary code on a developer’s machine. This exploitation occurs during an MCP OAuth authentication process and requires no additional user interaction or consent.
Technical Details and Vendor Response
Pillar Security reported the vulnerability privately via GitHub Security Advisory in late August 2026. The researchers assessed the flaw as critical with a CVSS score of 9.8. They noted that the attack vector involves passing URLs to PowerShell on Windows without proper escaping, allowing the shell to interpret parts of the URL as executable commands.
Anomaly, the company behind OpenCode, confirmed receipt of the report a month after the initial disclosure. At that time, the company stated that malicious MCP servers were outside their threat model. However, Anomaly released version 1.18.33 on September 28, which included a patch for the vulnerability.
Silent Patching Complicates Detection
The patch in version 1.18.33 was released without a Common Vulnerabilities and Exposures (CVE) identifier or a formal security advisory. Pillar Security researchers warned that this approach prevents conventional vulnerability scanners and dependency alerts from identifying affected installations. Consequently, enterprises may remain unaware that they need to upgrade their software to mitigate the risk.
Researchers argued that the standard fix implemented by Anomaly was insufficient. While version 1.18.33 added URL scheme checks, Pillar Security stated that URL validation alone cannot prevent the attack. Malicious payloads can be embedded in seemingly legitimate HTTPS URLs, bypassing simple scheme validation.
Affected Systems and Scope
The vulnerability specifically impacts users on Windows and Windows Subsystem for Linux (WSL). OpenCode is a widely used AI agent platform for software developers, boasting over 218,000 stars on GitHub. The sheer popularity of the tool increases the potential attack surface for developers who rely on it for daily coding tasks.
The crucial remediation step, according to Pillar Security, was updating the underlying dependency to a version that correctly quotes URLs. This prevents PowerShell from interpreting embedded payloads as executable code. Without this specific dependency update, the risk of remote code execution remains, even with added URL scheme checks.
What should you do?
Organizations using OpenCode should verify their current version immediately. If running version 1.18.32 or earlier, users should upgrade to version 1.18.33 or later as soon as possible. Since no CVE exists, automated scanning tools will not flag this issue, requiring manual verification of software versions across development environments.
Background: OAuth
The difference between OAuth and API key lies in identity and scope. An API key acts as a static password identifying a project or client to a system. OAuth is an authorization framework that allows third-party applications to obtain limited access to user accounts without exposing credentials.
Read the full guide: Difference Between OAuth and API Key and How to Choose
What to do and how to stay safe: OpenCode
- Manually check the installed version of OpenCode on all developer workstations and servers.
- Upgrade to version 1.18.33 or newer to ensure the patched dependency is in place.
- Monitor vendor communications for future security advisories, as silent patches may bypass standard alerting systems.
- Review network traffic for unusual MCP server connections during OAuth processes to detect potential exploitation attempts.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of OpenCode are affected by this vulnerability?
OpenCode versions 1.0.137 through 1.18.32 are affected by the critical remote code execution flaw.
Did the vendor provide a CVE for this vulnerability?
No, Anomaly patched the vulnerability in version 1.18.33 without assigning a CVE or issuing a security advisory.
How can an attacker exploit this vulnerability?
An attacker can use a malicious remote MCP server to execute arbitrary code during the MCP OAuth authentication process without user consent.
