OpenCode MCP OAuth RCE: silent patch, no CVE, check by hand

A remote MCP server could run code on a developer's machine just by being added to OpenCode, the open-source AI coding agent. Pillar Security found the OpenCode MCP OAuth RCE in versions 1.0.137 through 1.18.32 on Windows and WSL. No click needed. The fix shipped on September 28 in 1.18.33, but as a quiet refactor: no CVE, no security advisory. Your scanner has nothing to match. If your team runs OpenCode on Windows, you have to check versions yourself.

What actually happened

Pillar Security's write-up traces the bug to the OAuth flow OpenCode runs when it connects to a remote MCP server:

• During OAuth discovery, the MCP server sends back an authorization_endpoint URL. OpenCode opens it in the browser with the open npm package, pinned at 10.1.2.
• On Windows, that version of open builds a PowerShell command without escaping the URL. A $(...) inside an ordinary https:// link runs as a command. Checking the URL scheme does not stop it.
• macOS and Linux are not affected, Pillar says, because their browser launchers do not send the URL through a shell.

Pillar reported the flaw privately on August 29. Anomaly, OpenCode's maker, said malicious MCP servers are outside its threat model, then merged a fix on September 25 and published 1.18.33 three days later. Pillar says the real fix is the bump to open 11.0.4, which quotes the URL. The scheme checks added in the same release would not have blocked the payload. Infosecurity Magazine reports that the researchers rate it CVSS 9.8.

Why the OpenCode MCP flaw matters for your business

No CVE means no alert. Dependabot, Snyk and your endpoint tools match CVE IDs. A fix shipped as a refactor reaches nobody who only waits for alerts. Every AI dev tool on a laptop is now inventory you track yourself.

"Outside our threat model" is a vendor telling you something. An MCP server is code you invite in. If the client maker does not treat a hostile server as a real threat, you have to: approve each remote MCP server like you approve a browser extension.

Coding agents run on the machines with the keys. Developer laptops hold cloud credentials, SSH keys and production .env files. A one-step RCE there is a straight line to your infrastructure.

Sources: Pillar Security, Infosecurity Magazine.