Researchers disclose OpenCode flaw allowing commands during authentication

Pillar Security disclosed an OpenCode vulnerability on October 19 that could let a malicious remote server execute code on developers' Windows or Windows Subsystem for Linux machines during authentication, Infosecurity Magazine reported. Researchers identified affected versions as 1.0.137 to 1.18.32. The attack uses a model context protocol server, which connects external services to AI tools. An underlying dependency passed a URL to PowerShell without proper escaping, allowing embedded commands to run without additional consent. Researchers said OpenCode patched the flaw on September 28 in version 1.18.33 without a security advisory or CVE identifier, leaving conventional scanners unable to flag affected installations. They stressed that correcting URL quoting in the dependency was essential; URL scheme checks alone were insufficient.