OpenCode MCP OAuth remote code execution
Pillar Security disclosed that an attacker-controlled remote MCP server could execute arbitrary code on Windows or WSL machines during OpenCode's OAuth flow. The issue affected OpenCode 1.0.137 through 1.18.32; Anomaly shipped version 1.18.33 on September 28, before the public research disclosure.
Pillar Security reported that a remote MCP server could return attacker-controlled data during OAuth authentication and reach an OS-command-injection sink in OpenCode. The reported path needs no additional user interaction after the remote MCP connection is initiated and affects Windows and WSL deployments.
The research assigns a proposed CVSS v3.1 score of 9.8 and says no public CVE or vendor security advisory was issued. Pillar says the fix is OpenCode 1.18.33, released September 28, 2026.
Takeaway
Inventory Windows and WSL OpenCode installations and upgrade to 1.18.33 or later. Treat every remote MCP server and its OAuth response data as untrusted, including a server that was benign when first configured.