Security Alert: Critical Vulnerability in OpenCode AI Coding Tool Exposed
A recently uncovered vulnerability within the widely used open-source agentic AI coding tool, OpenCode, has been quietly rectified, leaving many users of affected older versions unaware of the potential risks, as highlighted by security researchers. OpenCode, which boasts an impressive following with over 218,000 stars on GitHub, is designed specifically to aid software developers in their projects.
According to a report published on October 19 by Eilon Cohen, the head of security research at Pillar Security, a severe remote code execution (RCE) vulnerability was identified in versions 1.0.137 through 1.18.32 of OpenCode. This flaw poses a significant threat as it can be exploited on both Windows operating systems and the Windows Subsystem for Linux (WSL). If malicious actors leverage this vulnerability, they can execute arbitrary code on a developer’s machine during an MCP OAuth authentication process, all without requiring any additional user interaction or consent.
The researchers at Pillar Security disclosed that this critical vulnerability was reported privately through GitHub Security Advisory with detailed reproduction material at the end of August 2026. By the end of September, the company behind OpenCode, known as Anomaly, acknowledged receipt of the report. However, Anomaly stated that harmful MCP servers were not considered part of their defined threat model.
Following this disclosure, Anomaly implemented a patch for the vulnerability on September 28, releasing version 1.18.33 of OpenCode. Notably, this patch was issued without a Common Vulnerabilities and Exposures (CVE) designation or an accompanying security advisory. Researchers from Pillar Security raised alarms over this approach, asserting that such an omission means conventional vulnerability scanners and dependency alerts are unlikely to detect the affected installations. Consequently, enterprises might remain oblivious to the necessity of upgrading their systems.
Inadequate URL Validation
The Pillar Security team pointed out that the standard remedial measures applied to this vulnerability do not adequately address the issue. They rated the severity of the vulnerability at an alarming CVSS score of 9.8. The researchers emphasized that merely validating URL schemes is insufficient to thwart attacks because malicious payloads can be concealed within seemingly legitimate HTTPS URLs.
In the case of Windows, the flaw allowed the vulnerable dependency to send URLs to PowerShell without the necessary escaping. This oversight enables PowerShell to interpret segments of the URL as executable commands. Although OpenCode attempted to fortify its defenses by adding URL scheme checks in version 1.18.33, the researchers argued that the primary fix lies in upgrading the dependency to one that accurately quotes URLs, thus preventing PowerShell from executing malicious code masked as part of the payload.
To mitigate the risk of command injection, researchers recommend that developers avoid passing untrusted URLs through shell commands altogether. Instead, they suggest utilizing argument-based process execution as a more secure alternative.
Vulnerability Unrelated to Recent Console Breach
This alarming report emerges just days after OpenCode confirmed a separate security breach impacting its Console. This feature facilitates the sharing of access to AI models via centrally managed API credentials. In discussions with Infosecurity, Cohen emphasized that the newly disclosed vulnerability was not related to the recent Console breach.
He clarified, “The breach hit a legacy system behind a hosted key proxy and exposed provider keys stored by users there. Conversely, the vulnerability we reported allows a malicious remote MCP server to execute code on a developer’s machine during the OAuth handshake process. The targets and attacker positions are therefore entirely different.”
Despite these distinctions, Cohen pointed out that both incidents ultimately highlight a critical concern: the importance of understanding who is trusted with credentials and inputs fed into AI coding tools, as well as what actions those tools are permitted to perform with the given permissions.
Conclusion
The discovery and patching of this critical RCE vulnerability in OpenCode raise significant concerns about transparency and awareness among users. As developers continue to rely on AI coding tools to streamline their processes, the importance of robust security practices cannot be understated. Both the OpenCode vulnerability and the Console breach serve as crucial reminders about the inherent risks of advanced technologies and the need for vigilance in safeguarding sensitive data and systems.