Affected Systems
OpenCode AI coding agent versions 1.0.137 through 1.18.32 on Windows and Windows Subsystem for Linux (WSL). macOS and Linux are not affected. Fixed in version 1.18.33 released September 28, 2024.
Exploitation Status
No CVE assigned. No evidence of active exploitation reported by Pillar Security. No public PoC available. Vulnerability requires developer to initiate sign-in with a malicious or compromised MCP server already configured.
Business Impact
Malicious or hijacked Model Context Protocol (MCP) servers can execute arbitrary PowerShell commands with developer privileges during OAuth sign-in flow. Attack requires developer to run 'opencode mcp auth' or equivalent request with a compromised MCP server configured. Risk is elevated for organizations using third-party or external MCP servers. No CVE means vulnerability scanners and dependency tools will not detect affected versions, requiring manual version checks.
Urgency
🟡 Within a week
Recommended Actions
- Upgrade OpenCode to version 1.18.33 or later on all Windows and WSL installations immediately
- Run 'opencode mcp list' to audit configured MCP servers and remove any untrusted or unvetted remote servers
- Check OpenCode version directly on developer workstations (versions 1.0.137 through 1.18.32 are vulnerable) since no CVE exists for automated scanning
- Review MCP server sources and ownership to identify servers that may have changed hands or been compromised
- Monitor for unusual PowerShell execution during OpenCode sign-in flows in endpoint detection logs