x.comthreadSanthosh Patel (@santhosh_patell) on X
Summary of Pillar Security research on opencode, in which a malicious remote MCP server runs code on a Windows or WSL machine during the OAuth login step. The login URL goes unsanitised into PowerShell through the npm "open" package, so an https:// link containing $(...) executes. Affected versions are 1.0.137 to 1.18.32, fixed in 1.18.33 (28 September) as a "refactor" with no advisory or CVE. The behaviour was first reported in 2020 as a WSL 2 broken-link bug.
TL;DR Thread says opencode on Windows/WSL (1.0.137 to 1.18.32) let a remote MCP server execute code via a crafted OAuth URL passed to PowerShell, silently fixed in 1.18.33.
Organisations named here
- CWE-78
- silent fix
Technologies named here
- open
- OpenCode
- Model Context Protocol
- PowerShell
- npm
- OAuth
- Windows
- Pillar Security
Related in AI Security
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
github.comadvisoryFlowise MCP Security Bypass Enables RCE
github.comrepoYesWeHack Claude Kit
jfrog.comarticle