Evidence record / opencode
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-opencode-the-mcp-oauth-command-injection-report-maps-to-september-fixes-in-both-release-lines
The MCP OAuth command-injection report maps to September fixes in both release lines. Retrospective fix, resurfaced by this week’s X leads: Pillar reports that a malicious configured remote MCP server could return an OAuth authorization URL which reached the open dependency and a PowerShell command path on Windows/WSL. The affected range it gives is 1.0.137 through 1.18.32. The attack does not require persuading the model through prompt injection. The source fixes centralize browser opening, permit only HTTP(S) URLs and upgrade open from 10.1.2 to 11.0.4; scheme validation alone would not address an injected expression inside an otherwise HTTPS URL. V1 first ships this in 1.18.33 on September 28; the analogous V2 fix is already in 2.0.18 on September 25. The researcher page has an October 19 header but an October 4 publication entry in its timeline; those inconsistent disclosure dates are not silently reconciled. No corresponding public GHSA/CVE was found in the three-entry repository advisory response read at 2026-10-24T09:37:25.967974Z.
Channel: tagged-release. Half: defect. Date: 2026-09-28.
Operator consequence: Upgrade older Windows/WSL installations to the current supported line and inspect which remote MCP endpoints are configured to initiate OAuth. Use the fixed application binary, not a claim that HTTPS alone makes an authorization URL safe. The current stable tags contain the fixes; this is not evidence of an active 2.1.4 exploit or an all-platform compromise. The trust decision moves to the integration endpoint and the browser-launch boundary, a path outside ordinary model tool approval.
Receipt
- https://github.com/anomalyco/opencode/commit/29f07e0c69ad8668e0e15b0eb54f2fcb342af98c
- https://github.com/anomalyco/opencode/commit/29ce49db0f5da1bd31e2ea60841a1d837f4237e1
- https://github.com/anomalyco/opencode/releases/tag/v1.18.33
- https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth
- https://github.com/anomalyco/opencode/security/advisories
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-opencode-the-mcp-oauth-command-injection-report-maps-to-september-fixes-in-both-release-lines
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-opencode-the-mcp-oauth-command-injection-report-maps-to-september-fixes-in-both-release-linesgithub.com/anomalyco/opencode/commit/29f07e0c69ad8668e0e15b0eb54f2fcb342af98ccommit2026-10-24-opencode-the-mcp-oauth-command-injection-report-maps-to-september-fixes-in-both-release-linesgithub.com/anomalyco/opencode/commit/29ce49db0f5da1bd31e2ea60841a1d837f4237e1github release2026-10-24-opencode-the-mcp-oauth-command-injection-report-maps-to-september-fixes-in-both-release-linesanomalyco/opencode / v1.18.33official docs2026-10-24-opencode-the-mcp-oauth-command-injection-report-maps-to-september-fixes-in-both-release-lineswww.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauthofficial docs2026-10-24-opencode-the-mcp-oauth-command-injection-report-maps-to-september-fixes-in-both-release-linesgithub.com/anomalyco/opencode/security/advisories
Versioned source: run artifact