CVE-2025-6514
CVSS 9.6 CRITICAL: mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the… EPSS 77% (100th percentile).
Vulnerabilities · 7h ago
Pillar Security disclosed that Anomaly fixed an OpenCode code-execution flaw in version 1.18.33 on September 28; versions 1.0.137 through 1.18.32 remain affected on Windows and Windows Subsystem for Linux (WSL). Anomaly published no security advisory or CVE identifier, leaving scanners without a vendor record to flag.
OpenCode connects to Model Context Protocol (MCP) servers for external tools. When a developer starts a server’s OAuth sign-in, that server supplies the web address OpenCode opens. On Windows and WSL, OpenCode passed the address into a PowerShell command without safely separating it from commands, so a crafted address could run attacker-chosen code with the developer’s access. Merely configuring a server is not enough; a later takeover can make the next sign-in dangerous.
For teams whose Windows developer fleets are inventoried only through scanners, affected OpenCode installs can remain unseen. The exposure depends on a developer initiating sign-in to a server an attacker controls—not simply on having that server configured.
CVSS 9.6 CRITICAL: mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the… EPSS 77% (100th percentile).
1 source covering this story
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A patched OpenCode flaw could let malicious MCP servers execute code on Windows and WSL when developers initiated OAuth sign-in.
Part of the PlainSec briefing for 2026-10-22