As cited
Copy frozen at (site build).
vulnerabilities
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A flaw in OpenCode, an artificial intelligence (AI) coding agent, allowed malicious or compromised Model Context Protocol (MCP) servers to execute code on a developer's Windows or WSL machine during sign-in with the developer's own privileges. Anomaly patched the vulnerability in version 1.18.33 in September.
Why it matters: Developers using OpenCode with untrusted or hijacked MCP servers face code execution risk on their local machines, potentially compromising their development environment and credentials. Update to version 1.18.33 or later immediately.
- Source published
- First seen by Cybersecurity Tracker