Signing in to opencode ran a crafted link through PowerShell

opencode, a coding agent by Anomaly, let a remote MCP server choose the URL it opened at sign-in. On Windows and WSL, opencode handed that URL to PowerShell through its default browser launcher. It looked like an ordinary link. PowerShell treats $(...) inside a double-quoted string as a command, so a valid https address can also run whatever sits inside the parentheses. The whole thing needed no extra click or consent beyond the sign-in itself.

Pillar Security reported the flaw and pointed to the dependency that actually fixed it. "What actually fixed opencode is the dependency bump," the firm wrote. Version 1.18.33, released 28 September, moved the open package from 10.1.2 to 11.0.4. The fix shipped quietly. It was presented as a refactor of browser-launch code, with no security mention in the pull request or the release notes. The scheme checks Anomaly added at the same time would not have stopped this payload. Anomaly issued no security advisory and requested no CVE, so scanners and dependency alerts will not flag the flaw.

The exposure is specific: versions 1.0.137 through 1.18.32, and only on Windows and WSL, where the browser launcher routes through a shell. macOS and Linux were never exposed. The server did not need to be malicious when configured, either; the payload arrives in the connection response, so a later compromise or an expired domain would do. The flaw is the same class as three 2025 CVEs in other MCP clients, including CVE-2025-6514.

Anomaly's position, per Pillar: defending against a malicious MCP server sits outside its threat model. Pillar still credits the fix as fast and better than it needed to be. Pillar is a security vendor with its own interest in the finding, and it published without a CVE or a vendor advisory. The dispute is unresolved.

Log take: The disclosure gap matters more than the bug, because a fixed flaw with no advisory leaves every scanner blind. (Interpretation; single-source, vendor-published, no CVE.)