Ethical Hacking News
A critical vulnerability has been discovered in OpenCode, an AI-powered coding agent that connects to MCP servers to enhance user experience. The flaw, which allows a malicious MCP server to execute code on a user's machine during sign-in, has been rated critical by Pillar Security. Users are advised to upgrade to OpenCode version 1.18.33 or later and to remove any remote MCP servers they have not vetted from their OpenCode configuration to protect their systems from potential threats.
A critical vulnerability was discovered in OpenCode, an AI-powered coding agent, allowing a malicious MCP server to execute code on a developer's Windows or WSL machine during sign-in. The vulnerability is caused by a flaw in the OpenCode browser helper and can be exploited by an attacker to inject malicious code into the user's machine. The vulnerability is rated critical, with a proposed severity score of 9.8 out of 10, due to its potential impact on user security. Users are advised to upgrade to OpenCode version 1.18.33 or later and to remove any remote MCP servers they have not vetted from their OpenCode configuration. A fix for the vulnerability was released in version 1.18.33, but the company did not request a CVE or publish a security advisory. The discovery highlights the importance of regular security testing and the need for companies to prioritize security in their products.
A recent discovery has shed light on a critical vulnerability in OpenCode, an AI-powered coding agent that connects to MCP (Model Context Protocol) servers to enhance user experience. The flaw, which was discovered by Pillar Security and disclosed on October 19, 2026, allows a malicious MCP server to execute code on a developer's Windows or WSL machine during sign-in. This vulnerability has been rated critical, with a proposed severity score of 9.8 out of 10.
The OpenCode AI coding agent is a widely used tool that connects to MCP servers to add external tools, allowing users to access a broader range of features and functionality. However, this feature also presents a security risk, as it allows a malicious MCP server to run code on the user's machine. The vulnerability is caused by a flaw in the OpenCode browser helper, which is a widely used package called "open." The helper is designed to open links in a browser, but it does not properly escape the URL, allowing an attacker to inject malicious code.
The vulnerability is particularly concerning because it allows an attacker to execute code on the user's machine without their knowledge or consent. This can be achieved by hijacking a remote MCP server that the user has added to their OpenCode configuration. The attacker does not need to be hostile from the start; they can simply take control of a server that the user has configured or use a domain that changes hands.
Pillar Security, the company behind the discovery, rates the vulnerability as critical due to its potential impact on user security. The company has published an advisory for the vulnerability, which recommends that users upgrade to OpenCode version 1.18.33 or later. Users who cannot upgrade yet are advised to remove any remote MCP servers they have not vetted from their OpenCode configuration.
The vulnerability is separate from a breach of OpenCode's hosted Console, which may have exposed some users' stored API keys for OpenAI, Anthropic, and Google. However, the discovery of the OpenCode flaw highlights the importance of regular security updates and the need for users to remain vigilant in protecting their systems from potential threats.
In response to the discovery, Anomaly, the company behind OpenCode, has released a fix for the vulnerability in version 1.18.33. However, the company did not request a CVE (Common Vulnerabilities and Exposures) or publish a security advisory, which means that vulnerability scanners will not flag the affected builds. As a result, finding affected installs requires checking the OpenCode version directly.
This vulnerability is not an isolated incident, as a similar flaw was discovered in July 2025, which affected the mcp-remote proxy. The discovery of the OpenCode flaw highlights the importance of regular security testing and the need for companies to prioritize security in their products.
In conclusion, the OpenCode flaw is a critical vulnerability that affects Windows and WSL systems. It allows a malicious MCP server to execute code on a user's machine during sign-in, highlighting the importance of regular security updates and user vigilance. Users are advised to upgrade to OpenCode version 1.18.33 or later and to remove any remote MCP servers they have not vetted from their OpenCode configuration.
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-OpenCode-Flaw-A-Critical-Vulnerability-Affecting-Windows-and-WSL-Systems-ehn.shtml
https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html
Published: Thu Oct 22 09:27:58 2026 by llama3.2 3B Q4_K_M
