OpenCode 1.0.137 to 1.18.32 on Windows and WSL: a remote MCP server's OAuth endpoint ran PowerShell at sign-in; fixed 1.18.33; CVE-2026-119025 (via `open`)

View raw markdownEdit on GitHub ↗

TL;DR

Pillar Security reports that OpenCode on Windows and WSL passed the authorization_endpoint an MCP server supplies during OAuth discovery straight to the open package (pinned at 10.1.2), which built a PowerShell command around it without escaping the URL, so a well-formed https address containing a PowerShell subexpression ran attacker-chosen commands with the developer's privileges when the developer started sign-in. The server need not be malicious when configured; a later takeover, a hijacked registry entry or an expired domain reaches the same path. Anomaly fixed it in 1.18.33 (npm 2026-09-28) by bumping open to 11.0.4 and adding a scheme check, in a pull request described as a browser-launch refactor whose release note says "MCP browser launch failures are now reported"; it told Pillar that a malicious MCP server is outside its threat model and declined to request a CVE, so no scanner will flag affected installs. Pillar's proposed CVSS 3.1 is 9.8; this file rates it high because the vector needs the developer to run opencode mcp auth against a remote server the attacker controls, on Windows or WSL. Upgrade, and inventory OpenCode on Windows hosts by hand.

What happened

Mechanism (Pillar Security, 2026-10-19). An MCP server that requires authorization answers with a 401 and a WWW-Authenticate challenge pointing to discovery documents; the authorization_endpoint field there is a free string the server chooses. It flowed through the MCP SDK, oauth-provider.ts, mcp/index.ts and browser.ts to open(), which on Windows escapes the application name but not the target URL and passes the command to powershell -EncodedCommand; PowerShell expands $(...) inside double-quoted strings. The browser launch then fails and OpenCode discards the error. CWE-78 with CWE-88. The report's central point is that scheme validation does not stop the payload, because it is a well-formed https: URL with no spaces: the MCP SDK's denylist (javascript:, data:, vbscript:) allows it, the stricter http/https allowlist the SDK rejected (PR #841, closed; PR #877 merged in 1.17.4) would allow it, and OpenCode's new openUrl() check allows it. The change that closed the hole was open 11.0.4, which wraps the target in single quotes.

History of the sink. open issue #202 (2020-10-22) reported URLs with $ breaking on WSL; issue #323 (2023-10-18) described the command injection with a one-line proof, and the maintainer replied that sanitising untrusted input is the caller's job, which the README has said since 2021-09-17; open 11.0.0 (2025-11-15) fixed PowerShell argument escaping. OpenCode added await open(authorizationUrl) on 2025-12-07 (commit 509e43d6) with open@10.1.2 already pinned. Pillar lists three earlier CVEs on the same sink: mcp-remote CVE-2025-6514, openmcp-client CVE-2025-58062, sequa-mcp CVE-2025-10619.

Disclosure. Reported privately through a GitHub Security Advisory on 2026-08-29; on 2026-09-25 Anomaly confirmed receipt, said malicious MCP servers are outside its threat model, and merged PR #51414 (commit 29f07e0c: open to 11.0.4, a new openUrl() rejecting non-http(s) schemes, a scheme check in redirectToAuthorization); Pillar asked for a CVE and said it would publish; 1.18.33 reached npm on 2026-09-28. Pillar's page is dated 2026-10-19 and The Hacker News reports the public disclosure as 10-19; the page's own timeline prints 2026-10-04 as the publication date, a discrepancy this file records rather than resolves. The Hacker News adds that Pillar later asked Anomaly to reconsider the CVE and that Pillar reports no known exploitation and published no indicators. OpenCode's security policy says user-configured MCP servers are "outside our trust boundary"; its advisories tab (read 2026-10-22) lists three unrelated advisories and nothing for this.

Registry. npm opencode-ai, read 2026-10-22: newest 1.19.4 (2026-10-22). Pillar contrasts gemini-cli (scheme-gated execFile), Claude Code (the OAuth path cannot pass a server value to the opener), github-mcp-server and Docker mcp-gateway (argv openers, operator-chosen authorization servers) as clients that avoid the sink.

Why it is here: it is the mcp-remote bug class a year on, in a coding agent with its own breach five days earlier, with the twist that the vendor's position and the missing CVE leave the affected range invisible to dependency tooling.

Am I affected?

  • Windows or WSL, opencode --version between 1.0.137 and 1.18.32, and at least one remote MCP server configured. opencode mcp list shows them.
  • The code ran only when the developer started sign-in (opencode mcp auth or the matching request). Configuring the server or opening a session did not trigger it.
  • No CVE, so npm audit, Dependabot and SCA tools will not report it; inventory by version.

If you are affected

  1. Upgrade to 1.18.33 or later (1.19.4 is current).
  2. If you cannot upgrade, remove unvetted remote MCP servers from the configuration; Pillar says keeping them means accepting the exposure.
  3. If a sign-in was run against a server you did not control while on an affected version on Windows or WSL, treat the machine as having run that server's command: if an MCP server was malicious, then if your local AI agent was exploited.
  4. Maintainers of anything that calls open: pass nothing remote to it; 11.x escaping is a layer, not a fix; scheme checks are necessary and insufficient; use argv openers.

Prevention

  • MCP hygiene: every server-controlled field is untrusted input, including OAuth discovery; bind discovery to the configured origin.
  • Agent sandboxing.

Update 2026-10-29 — a CVE exists after all, filed against the open library with OpenCode as an affected product: CVE-2026-119025 (VulnCheck, 7.7)

VulnCheck published CVE-2026-119025 on 2026-10-29 for open 7.2.0 before 11.0.0, listing anomalyco/opencode 1.0.137 before 1.18.33 and modelcontextprotocol/inspector 2.0.0 before 2.12.0 as affected products, with Eilon Cohen (Pillar Security) credited and the OpenCode PR #51414 and commit 29f07e0c among the references. CVSS 4.0 7.7, CVSS 3.1 7.5. The vendor still has no advisory on its tab; the id is the library's. A dependency scanner keyed to this CVE will flag open below 11.0.0 in a lockfile and will not flag OpenCode itself, because opencode-ai ships a bundle with no open entry in its dependencies; the inventory-by-version advice above stands. MCP Inspector's own advisory (GHSA-q978-78c7-phqw, 2026-10-21, fixed 2.12.0) and the pins other MCP clients still carry are in the open advisory. The "no CVE" in this file's title and the no-cve tag described the state until 2026-10-29.

Sources for this update: CVE Services — CVE-2026-119025 — fetched 2026-10-29: the three affected products and ranges, the scores, the references, the credit. npm opencode-ai, read 2026-10-29: no open in dependencies.

Sources