David Gutierrez | Eng (@david_x_ai) on X

What it is

A thread by David Gutierrez (@david_x_ai) on the Pillar Security disclosure of 19 October, a critical bug in the opencode coding agent. On Windows and WSL, a remote MCP server could run code on the user's machine during OAuth sign-in. The thread says no prompt injection and no model are involved.

How it works

The MCP server chooses the authorization URL. opencode passed that URL to a helper that built a PowerShell command around it without escaping. A URL containing a PowerShell subexpression therefore ran with the user's privileges.

Preconditions / Affected

• opencode on Windows or WSL, before 1.18.33.
• The user signs in via OAuth to a remote MCP server that is hostile or has become hostile.
• MCP Inspector has the same bug class. It published an advisory two days after the opencode disclosure. Its suggested fix is a major bump of the open package.
• A caret range on open 10.x never resolves to 11.x, so a routine npm update will not apply the fix.

What to do

Upgrade opencode to 1.18.33 or later. The fix shipped on 28 September as a browser-launch refactor, with no advisory and no CVE, so scanners have nothing to flag. For MCP Inspector, raise the open dependency to the new major version by hand.

The thread's list for this week:

opencode mcp list

• Use that command as a starting point to list every MCP server your agents can reach.
• Remove any remote server you have not vetted.
• Pin agent tool versions and read release diffs, not release notes.
• Treat a server's domain changing hands as a supply chain event.

Caveats

The thread is a summary by a third party, not the Pillar Security report or the MCP Inspector advisory. It gives no CVE id, no advisory link and no exact open version numbers. Verify the affected and fixed ranges against those primary sources.