OpenCode MCP Flaw on Windows: Check Your Version and Upgrade Today
OpenCode 1.0.137 through 1.18.32 on Windows and WSL let a remote MCP server run code on your machine during OAuth sign-in. Upgrading to 1.18.33 or later closes the flaw, and auditing every remote server you previously added cleans up residual risk. Because no CVE was requested for this flaw, automated vulnerability scanners will not alert you. Here is how to verify your version, upgrade cleanly, and secure your Model Context Protocol environment.
⚡ Quick answer: How to verify and remediate in 3 minutes
The OpenCode MCP vulnerability fix for Windows and WSL starts with one command. Run opencode --version in your terminal. If the result is 1.0.137 through 1.18.32, upgrade to 1.18.33 or later, then run opencode mcp list and remove any remote MCP server you have not vetted. Installs on macOS and Linux are not affected by this flaw, according to Pillar Security and the coverage that followed its report. The reason this check matters is that no CVE was issued for the flaw, so a scanner will not flag an affected install for you. You have to check the version yourself, and the steps below take a few minutes.
opencode --version && opencode upgrade && opencode mcp list
- Why this matters now: The CVE gap and the OAuth trigger
- What you need before you start
- Check, upgrade, and audit: The 6-step remediation guide
- Technical deep-dive: Why Windows and WSL were vulnerable while Linux was not
- What to do if the upgrade fails or breaks
- Frequently asked questions
- Conclusion & next steps
- Sources & primary references
Why this matters now: The CVE gap and the OAuth trigger
Pillar Security disclosed the flaw in October 2026. Its disclosure timeline records a private report to Anomaly on 29 August 2026, a merged fix on 25 September 2026, and version 1.18.33 published to npm on 28 September 2026. Wider coverage followed on 22 October 2026. The gap between the fix and the disclosure is the point of this post. A user who installed OpenCode before 28 September and never upgraded could still be running an affected build, and nothing in a normal update feed would have told them the release was a security fix, because the change shipped as a refactor of browser launch code with no advisory attached.
The flaw sits in the Model Context Protocol (MCP) OAuth sign-in flow. During sign-in, the remote MCP server supplies the authorization endpoint URL that OpenCode opens in a browser. On Windows and WSL, affected builds passed that URL into a PowerShell command without escaping it, so a crafted URL could run commands with the developer's own access. Pillar Security proposed a severity score of 9.8 out of 10.
Two limits on the risk are worth stating plainly:
- Authentication trigger: The browser step runs only when the developer starts sign-in, with
opencode mcp author the matching request, so configuring a server or opening a session does not reach it. - Server control required: The attacker needs control of a remote MCP server the developer added, though that server need not have been hostile from the start, since a later compromise or an expired domain changing hands could deliver the same URL.
Pillar Security reported no signs that the flaw has been used in attacks, and it published no indicators for checking past exploitation, so this post does not pretend you can scan for a past hit. The fix is to move off the affected range and to prune servers you do not trust.
One more distinction prevents a mix-up that has already appeared in coverage. This flaw is separate from a breach of OpenCode's hosted Console disclosed around the same time, which may have exposed some users' stored provider keys. The steps below address the MCP sign-in flaw only. If you use the hosted Console, check its own notices separately.
What you need before you start
Before executing the remediation steps, verify you have the following prerequisites ready:
- A Windows or WSL machine with OpenCode installed
- A terminal (PowerShell, Command Prompt, or WSL bash), and a few minutes
- No new account, and no paid service required
Check, upgrade, and audit: The 6-step remediation guide
Follow these six steps in sequence to verify, upgrade, and audit your OpenCode environment.
Step 1: Check your OpenCode version
Open your terminal and run this command:
opencode --versionWrite down the number it prints. You will compare it with the range in step 2 before you change anything, so you know whether the rest of the steps apply to you.
Step 2: Read the result against the affected range
Pillar Security lists versions 1.0.137 through 1.18.32 on Windows and WSL as affected, and 1.18.33 as the fixed release. Use this reading:
| Your version & OS | Status | What it means |
|---|---|---|
| 1.0.137 through 1.18.32 on Windows or WSL | Affected | Upgrade before you sign in to any remote MCP server again. |
| 1.18.33 or later | Patched | Outside the affected range. You can move on to the server audit in step 4. |
| Any version on macOS or Linux | Unaffected | Not affected by this flaw. The audit in step 4 is still good practice. |
If your install offers a move to a new major version during the upgrade, read its migration notes before accepting it. The goal of this post is a fixed build, and a major version move is a separate decision.
Step 3: Upgrade to a fixed version
Run the upgrade command for your install:
opencode upgradeIf you installed OpenCode with npm, this command also works:
npm i -g opencode-ai@latest
Then run opencode --version again and confirm the number is 1.18.33 or later. Do not accept a result in the affected range as fixed.
If the number does not change, you may have two installs on the machine, and the shell is running the one you did not upgrade. In Command Prompt or PowerShell, run:
where opencode
In WSL or bash, run which -a opencode. Upgrading the install at the path your shell actually executes will resolve that case.
Step 4: List every configured MCP server
Run this command to inspect all registered servers:
opencode mcp listThe list shows the servers OpenCode will connect to. Read it slowly. A server you added months ago and forgot about counts just as much as one you added yesterday, because the flaw triggers at sign-in time, and a server can change hands after you add it.
Step 5: Remove servers you have not vetted
Keep a remote server only if you can answer yes to each of these three questions:
- Origin verification: Did you add it yourself?
- Identity verification: Do you recognise the provider behind it?
- Trust persistence: Would you still trust it if its domain changed hands tomorrow?
If any answer is no, remove that server entry from your OpenCode config and do not sign in to it again until you have vetted it. Local servers that run on your own machine (such as local SQLite or filesystem tools running via stdio) are a different case from remote servers, because no remote party supplies their sign-in URL, so focus this pass on remote entries first.
To remove an unvetted server from your OpenCode configuration, run:
opencode mcp remove <server-name>Step 6: If you cannot upgrade yet, stop signing in to unvetted servers
Pillar Security gives this fallback plainly. If you cannot upgrade and you are on Windows or WSL, remove unvetted and untrusted remote MCP servers from your OpenCode config until you can upgrade. Do not run opencode mcp auth for a server you have not vetted while you are still on an affected build. This fallback reduces the exposure, and it does not replace the upgrade, so treat it as a stopgap with a date attached, not as a settled state.
Technical deep-dive: Why Windows and WSL were vulnerable while Linux was not
To understand why this vulnerability existed specifically on Windows and WSL, it helps to examine how operating systems handle process execution and argument parsing.
When an AI coding assistant connects to a remote MCP server using OAuth, the server provides an authorization endpoint URL. To authenticate, the CLI must launch the developer's default web browser with this URL.
On POSIX platforms (native macOS and Linux), the agent invokes browser utilities such as open on macOS or xdg-open on Linux via standard system calls (like execvp) where arguments are passed as discrete array elements. The URL is treated strictly as data and is never parsed as executable shell syntax.
On Windows and within WSL environments invoking host Windows tools, the browser launch logic constructed a single command string passed to powershell.exe (for example, powershell.exe -Command Start-Process "<URL>"). Because the URL supplied by the remote MCP server was concatenated without strict sanitization or escaping, malicious characters (such as semicolons, ampersands, backticks, or subshell invocations) allowed an attacker to break out of the string and execute arbitrary PowerShell commands with full user permissions.
Version 1.18.33 replaced this shell-based browser launch with sanitized execution routines, eliminating PowerShell command string interpolation.
What to do if the upgrade fails or breaks
- Version remains unchanged: If
opencode upgradedoes not change your version, upgrade through the method you installed with, such as the npm command in step 3 or your desktop app updater, then check the version again. - Empty server list: If the server list comes back empty but you expected servers, check that you are looking at the config for the right project and profile, since an empty list means no servers are configured for that context.
- Workflow regression: If a workflow breaks after the upgrade, do not roll back to a version in the affected range. Read the release notes for the new version and fix the workflow there, because a rollback would put the flaw back on the machine.
- Uncertain server safety: If you are unsure whether a server is safe, remove it and re-add it only after you have checked its provider and its URL by hand.
Frequently asked questions
No. Pillar Security and the coverage of its report state that macOS and Linux are not affected, because OpenCode opens the browser there without passing the address through a shell. The version check still costs seconds, and the server audit is still worth doing, but this flaw does not apply to those installs.
Because no CVE was requested and no security advisory was published for this flaw. Scanners and dependency alerts match against CVE records, so an affected build looks ordinary to them. Pillar Security states this directly as the reason teams must inventory OpenCode versions themselves. The proposed score of 9.8 out of 10 comes from Pillar Security, not from a CVE record.
No. The browser step that carries the flaw runs only when you start sign-in, with opencode mcp auth or the matching request. Configuring a server or opening a session does not reach it. That limit narrows the fix. You still need to upgrade, and you still need to prune unvetted servers, but you do not need to treat every configured server as an active compromise.
Remove unvetted remote MCP servers from your OpenCode config now, and do not sign in to them until you have upgraded. That is Pillar Security's stated fallback for Windows and WSL users who cannot upgrade yet. Set a time to finish the upgrade, because the fallback only holds while those servers stay removed.
No. The Console incident concerns the hosted service and possibly exposed stored provider keys, while this flaw concerns the OpenCode agent's MCP sign-in flow on Windows and WSL. Treat them as two separate items, and check the Console notices on their own terms if you use that service.
Conclusion & next steps
The OpenCode MCP vulnerability fix for Windows and WSL is a version check, an upgrade, and a server audit, in that order. Check the version first, because the absence of a CVE means no scanner will do it for you. Upgrade to 1.18.33 or later, then prune remote servers you have not vetted, and do not sign in to an unvetted server while you are still on an affected build.
If you are setting up MCP servers from scratch after this cleanup, explore PromptStaging's interactive tools to configure, audit, and safeguard your coding agents:
- Model Context Protocol (MCP) Config Studio — Build verified JSON configs with local secret masking and clean syntax.
- Stop Agent Secret Leaks with shim-cli — Mask credentials and tokens on your machine before they reach language models.
- How to Safely Audit a SKILL.md Before Installing — Complete 7-step checklist to detect hidden Unicode and malicious code in agent skills.
- Universal Agent Skills Directory — Discover 66 pre-screened skills compatible with Claude Code, Cursor, Codex, and Copilot.
Sources & primary references
- Pillar Security: Open and shut: remote code execution in OpenCode via MCP OAuth
- The Hacker News: OpenCode flaw lets malicious MCP servers execute code during sign-in on Windows and WSL
- Infosecurity Magazine: Researchers warn OpenCode quietly patched critical RCE flaw
- OpenCode CLI Reference: OpenCode CLI command cheat sheet and upgrade references