Severity: High | Priority: 2
OpenCode is an open-source AI coding agent. Versions 1.0.137 through 1.18.32 on Windows and WSL let a malicious or hijacked remote MCP server run commands on the developer’s machine.
The attack happens when the developer signs in to that server, for example with opencode mcp auth. The server supplies an OAuth authorization address. OpenCode passes that address to a PowerShell command without escaping it, so commands hidden inside an otherwise normal HTTPS link run on the machine.
macOS and Linux are not affected. Version 1.18.33, released on September 28, 2026, fixes the flaw. No CVE or vendor advisory was issued, so vulnerability scanners and dependency alerts will not flag affected installations.
If an alert is raised, a developer machine on your network has received an OAuth discovery document whose authorization address contains hidden PowerShell syntax. If the developer completed sign-in on an affected OpenCode version, those commands may have run.