Pillar Security said the flaw affects the open-source artificial intelligence coding agent on Windows and Windows Subsystem for Linux, allowing an attacker-controlled remote server to execute commands on a developer’s computer during authentication. Anomaly, the company maintaining OpenCode, corrected the problem in version 1.18.33 on 28 September but did not request a Common Vulnerabilities and Exposures identifier, or CVE.
The absence of an advisory and vulnerability identifier means automated security scanners and dependency monitoring systems may not alert organisations still running affected versions, Pillar warned in findings published on 19 October. Its researchers urged administrators to check installations directly and upgrade where necessary.
Versions 1.0.137 through 1.18.32 are affected, according to the researchers. The vulnerability depends on a connection to a malicious or compromised remote Model Context Protocol server, which provides external tools and services to AI coding agents. Ordinary macOS and Linux installations are not affected by the Windows-specific command execution mechanism.
Pillar’s head of security research, Eilon Cohen, disclosed the issue after his team traced an authentication response from a remote server into a browser-opening utility. During the OAuth authorisation process, the server supplies an endpoint address that OpenCode uses to launch a browser. On affected Windows systems, the utility passed that address into PowerShell without adequate escaping.
An attacker could place command syntax inside the supplied address, causing PowerShell to interpret part of it as executable instructions. The payload could be embedded in an apparently ordinary HTTPS address, meaning checks that simply restrict links to recognised web protocols would not prevent exploitation.
The researchers assessed the flaw at 9.8 out of 10 on the Common Vulnerability Scoring System, a critical rating. That is their proposed severity assessment rather than a score associated with an assigned CVE. Their analysis did not establish that attackers had exploited the weakness against users outside a controlled test.
Pillar privately notified the maintainers through GitHub’s security advisory process on 29 August, supplying material to reproduce the issue. According to its disclosure chronology, Anomaly acknowledged the submission on 25 September and said malicious remote MCP servers fell outside its threat model.
A code change merged that day altered browser-launch handling, and the updated release followed three days later. Pillar credited Anomaly with implementing a substantial technical correction, while criticising the lack of an accompanying security notice that would explain the urgency of upgrading.
The patch upgraded the underlying open package to version 11.0.4, which changes how the target address is handled before reaching PowerShell. OpenCode also introduced a shared URL-opening function and additional checks on permitted address schemes. Pillar said the dependency upgrade was decisive because protocol validation alone would not block a crafted HTTPS payload.
The modification was presented as a refactoring of browser-launch code rather than a security fix. Neither the change description nor the release notes identified the vulnerability, according to Pillar. The researchers argued that users examining routine upgrade announcements would therefore have little reason to recognise the potential consequences of remaining on older builds.
Pillar recommended that organisations inventory Windows and WSL deployments and install version 1.18.33 or later. Where immediate upgrades are impossible, it advised removing untrusted remote MCP server configurations. It also urged software maintainers to avoid passing externally supplied addresses into shell command strings, favouring process interfaces that separate executable arguments.
The researchers distinguished this issue from a separate security incident involving OpenCode Console, a hosted service used to manage access to AI models. Cohen said that incident concerned stored provider credentials, whereas the newly described vulnerability involved code execution on a developer’s own machine during a remote authentication exchange.
The risk does not require a developer to approve a second action after the compromised server supplies the authentication response, Pillar said. A server initially considered trustworthy could also become dangerous following a takeover or a change in control of its domain, broadening the circumstances in which exposure might arise.
The vulnerability resembles command-injection weaknesses previously documented in other software using the same browser-opening dependency. Pillar said earlier disclosures had already shown the dangers of trusting authentication endpoints supplied by external servers, even when those endpoints appeared to use standard web addresses.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
