Open Code Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

Summary: A flaw in the OpenCode AI coding agent let a malicious or hijacked MCP server run code with the developer's own access on Windows and WSL when the developer signed in, because OpenCode passed the server-supplied OAuth authorization endpoint to a browser helper that built an unescaped PowerShell command around it. Anomaly fixed it in version 1.18.33 on September 28 without requesting a CVE or publishing an advisory, leaving builds 1.0.137 through 1.18.32 unflagged by scanners; Pillar Security, which found the flaw and disclosed it on October 19, rates it critical at a proposed 9.8 out of 10.
Why it matters: With no CVE and a fix shipped as a routine browser-launch refactor, nothing in your scanners or dependency alerts will surface the OpenCode installs still at risk - and Anomaly's position is that user-configured MCP servers sit outside its trust boundary, so the exposure is yours to find by checking versions directly.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-6514
Related: [Webinar] Securing Agentic AI: From MCPs and Tool Access to Shadow API Key Sprawl Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026