What happened
Pillar Security disclosed (2026-10-19) a critical RCE in the popular open-source AI coding agent opencode: an attacker-controlled remote MCP server can execute arbitrary code on a Windows/WSL developer machine during the automatic MCP OAuth authentication process, without extra user interaction or consent. Proposed CVSS 9.8 (Critical, AV:N/AC:L/PR:N/UI:N). The same sink class was documented in CVE-2025-6514 (9.6) and two other 2025 CVEs; opencode's vulnerable code was written in December 2025 and Anomaly did not publish an advisory or request a CVE.
Why it matters
This is a credentialless agent-tool chain: connecting a coding agent to any remote MCP server (public, typosquatted, or later hijacked) can hand an attacker code execution on the developer's machine — which holds the cloud, SSH, git, and model-provider credentials those agents use. The disclosure gap means most enterprises will not know they are exposed.
Attack vector
During a remote MCP server's OAuth 401 challenge, the attacker-controlled authorization_endpoint string flows straight from the wire into a shell invocation (the browser-launching package open/xdg-open) with no scheme validation or origin check (CWE-78 OS command injection). A malicious or later-compromised/hijacked remote MCP server can trigger arbitrary code execution on the developer's host.
Affected systems
opencode (opencode-ai on npm) >= 1.0.137, <= 1.18.32, on Windows and WSL
Mitigation
Upgrade to opencode 1.18.33 (released 2026-09-28). Because Anomaly shipped the fix as a silent refactor with no advisory or CVE, inventory affected installations directly — dependency scanners will not flag it.