OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

A critical vulnerability in OpenCode versions 1.0.137 through 1.18.32 allows a malicious or compromised MCP (Model Context Protocol) server to execute arbitrary code on a developer's Windows or WSL machine during sign-in. The flaw arises because OpenCode passes an untrusted OAuth authorization endpoint URL from the MCP server to a browser helper without proper escaping, leading to command injection via PowerShell on Windows. The vulnerability was fixed in version 1.18.33, but no CVE was assigned, and it remains unflagged by vulnerability scanners. Although no active exploitation has been observed, the risk persists for unpatched installations connected to untrusted MCP servers.

AI-extracted · verify before operational use