If you use OpenCode on Windows or in WSL, security firm Pillar Security says you should make sure you're on version 1.18.33 or later. In a report dated October 19 on its blog, Pillar says versions 1.0.137 through 1.18.32 on those platforms have a remote code execution flaw that a remote MCP server can trigger during OAuth sign-in. Anomaly, the company behind OpenCode, fixed it in 1.18.33 on September 28 but didn't publish a security advisory or request a CVE, so Pillar says vulnerability scanners and dependency alerts won't tell anyone to update.
Who is affected
According to Pillar, the problem only affects OpenCode on Windows and in WSL, and only when you have remote MCP servers configured. The flaw sits in the step where OpenCode opens a sign-in page for a remote MCP server that uses OAuth. Pillar says a malicious or compromised server can use that step to run code on the developer's machine, with no further action or consent from the user. OpenCode on macOS and native Linux isn't affected, Pillar says, because the browser launcher on those systems doesn't pass the address through a shell.
Pillar also points out that a server doesn't have to be malicious when you first add it. Because the harmful data arrives when OpenCode connects, a server that's hacked later, a hijacked registry entry, a lookalike name or an expired domain could lead to the same result.
Pillar rates the flaw 9.8 out of 10, which it labels critical. That's Pillar's own proposed score; no public CVE has been assigned.
How the fix shipped
Pillar says it reported the issue privately through GitHub on August 29. The fix was merged in late September and released in OpenCode 1.18.33 on September 28. We checked both the pull request and the release notes, and neither mentions security; the pull request is titled as a refactor that shares one browser opener across OpenCode and its terminal interface.
Pillar describes the fix itself as fast and more thorough than it needed to be, with changes in three places. In Pillar's view, the part that actually closed the hole was an update to a library OpenCode uses to open web pages, not the new checks on what kind of address can be opened.
According to Pillar, Anomaly said that dealing with a malicious MCP server falls outside its threat model, which is why it didn't publish an advisory. That account comes from Pillar. Neither Anomaly nor Dax (@thdxr), whose X bio says they build OpenCode, has commented publicly.
What to do
Pillar's advice is to update to OpenCode 1.18.33 or later. If you're on Windows or WSL and can't update yet, it suggests removing any remote MCP servers you haven't vetted from your OpenCode configuration until you can. Because there's no CVE for scanners to match, Pillar says security teams will need to check their OpenCode installs directly.