OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

A security flaw in the OpenCode AI coding assistant allowed a hostile or compromised MCP (Model Context Protocol) server to execute arbitrary commands on a developer's machine during the sign-in process. The issue, found by Pillar Security, stemmed from OpenCode passing an attacker-controlled OAuth authorization URL into an unescaped PowerShell command on Windows and WSL systems, letting a crafted address trigger code execution with the victim's own privileges. macOS and Linux were not affected since OpenCode launches browsers there without a shell. Anomaly, the maker of OpenCode, quietly fixed the problem in version 1.18.33 released September 28, folding it into a routine browser-launch refactor without issuing a CVE or advisory, and reportedly told researchers it does not consider malicious MCP servers part of its threat model. Pillar rated the bug critical with a severity score of 9.8/10, noting it closely resembles CVE-2025-6514 found in the mcp-remote proxy last year; users on affected versions (1.0.137 through 1.18.32) should upgrade immediately and audit which MCP servers they have configured.