OpenCodeAI kodlash agentidagi zaiflik zararli yoki buzilgan MCP serverga ishlab chiquvchining Windows yoki WSL mashinasida kodni bajarishga imkon berdi, ishlab chiquvchi tizimga kirganida. OpenCode tashqi vositalarni qo'shish uchun MCP (Model Context Protocol) serverlariga ulanadi va bunday kod ishlab chiquvchining o'z huquqlari bilan bajariladi.
OpenCode ortidagi Anomaly kompaniyasi zaiflikni 28-sentabrda 1.18.33 versiyasida tuzatdi. U CVE so'ramadi va xavfsizlik e'lonini nashr etmadi, shuning uchun zaiflik skanerlari hali ham xavf ostida bo'lgan 1.0.137 dan 1.18.32 gacha bo'lgan versiyalarni aniqlamaydi.
Kirish paytida serverning o'zi foydalanuvchini yuboradigan veb-manzilni, OAuth "avtorizatsiya nuqtasi"ni taqdim etadi. Windows va WSL'da OpenCode bu manzilni brauzerda ochadigan yordamchiga uzatdi. Yordamchi manzil atrofida PowerShell buyrug'ini qochirishsiz tuzdi, shuning uchun PowerShell buyrug'ini o'z ichiga olgan manzil shu buyrug'ni bajaradi.
Brauzer bosqichi faqat ishlab chiquvchi tizimga kirishni boshlaganda, ya'ni opencode mcp auth buyrug'ini ishga tushirganda yoki mos so'rovni yuborganda ishlaydi. Serverni sozlash yoki sessiyani ochish bu bosqichga yetmaydi.
Hujumchi ishlab chiquvchi qo'shgan masofaviy MCP serverini nazorat qilishi kerak va bu server boshidan dushman bo'lishi shart emas. Keyinchalik egallab olingan yoki domeni o'zgargan server ham xuddi shu manzilni olib yurishi mumkin.
Zaiflikni topgan va 19-oktabrda e'lon qilgan Pillar Security uni tanqidiy deb baholaydi va 10 dan 9,8 ballik jiddiylik darajasini taklif qiladi.
Zaiflik Windows va Windows Subsystem for Linux (WSL) dagi OpenCode'ga ta'sir qiladi. macOS va Linux ta'sirlanmaydi, chunki OpenCode u yerda manzilni shell orqali o'tkazmasdan brauzerni ochadi.
OpenCode tuzatishni odatiy o'zgarish sifatida jo'natdi. Uni o'z ichiga olgan pull-request brauzerni ishga tushirish kodini qayta ishlash deb ta'riflanadi va na u, na reliz eslatmalari xavfsizlik zaifligini eslatmaydi.
Anomaly CVE so'ramadi va e'lon nashr etmadi. Uning xavfsizlik siyosati foydalanuvchi sozlagan MCP serverlari "bizning ishonch chegaramizdan tashqarida" deb aytadi.
Pillar zaiflikni 29-avgustda shaxsiy tarzda xabar qildi va keyinchalik Anomaly'dan qayta ko'rib chiqishni va CVE so'rashni so'radi. Pillar ma'lumotiga ko'ra, Anomaly javobi shunday bo'ldi: zararli MCP server uning tahdid modelidan tashqarida.
CVE yo'qligi sababli zaiflik skanerlarda yoki bog'liqlik ogohlantirishlarida ko'rinmaydi, shuning uchun ta'sirlangan o'rnatmalarni topish OpenCode versiyasini to'g'ridan-to'g'ri tekshirishni talab qiladi. Anomaly bu yil OpenCode'dagi boshqa kod bajarish zaifliklari, jumladan avgustda tuzatilgan biri uchun e'lonlar nashr etgan.
Xuddi shu turdagi zaiflik avval ham uchragan. 2025-yil iyulda mcp-remote proxy deyarli bir xil xatoga ega edi, unda zararli serverning avtorizatsiya nuqtasi buyruq qatoriga yetib borardi. Unga CVE-2025-6514 raqami berildi.
OpenCode'ning brauzer yordamchisi keng tarqalgan open nomli paketdir. Uning Windows'dagi xatti-harakatlari 2023-yilda buyruq in'ektsiyasi xavfi sifatida xabar qilingan va open'ning 11-versiyasida tuzatilgan, ammo OpenCode eski relizda qolgan.
Bu turdagi zaiflikdan odatiy himoya manzil HTTP yoki HTTPS ishlatishini tekshirishdir. Bu yerda yordam bermaydi, chunki hujum oddiy HTTPS manzilidan foydalanadi. OpenCode ham bu tekshiruvni qo'shdi, ammo teshik uni tuzatilgan versiyaga yangilash orqali yopildi.
Nima qilish kerak
Windows yoki WSL'da OpenCode ishlatayotgan har kim yangilanishi va qaysi serverlarga ulanganini tekshirishi kerak.
- OpenCode 1.18.33 yoki undan keyingi versiyaga yangilang.
- Agar hozircha yangilay olmasangiz, OpenCode sozlamalaringizdan tekshirilmagan har qanday masofaviy MCP serverlarini olib tashlang.
- Qaysi serverlar sozlanganini ko'rish uchun opencode mcp list buyrug'ini ishga tushiring.
Pillar zaiflikning hujumlarda ishlatilganiga oid belgilar yo'qligini xabar qildi va o'tmishdagi ekspluatatsiyani tekshirish uchun hech qanday indikator nashr etmadi. Zaiflik xuddi shu vaqtda e'lon qilingan OpenCode'ning joylashgan Console buzilishidan alohida bo'lib, u ba'zi foydalanuvchilarning saqlangan OpenAI, Anthropic va Google API kalitlarini fosh qilgan bo'lishi mumkin.
A flaw in the OpenCodeAI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access.
Anomaly, the company behind OpenCode, fixed the flaw in version 1.18.33 on September 28. It did not request a CVE or publish a security advisory, so vulnerability scanners will not flag the builds still at risk: 1.0.137 through 1.18.32.
During that sign-in, the server itself supplies the web address the user is sent to, an OAuth "authorization endpoint." On Windows and WSL, OpenCode handed that address to a helper that opens it in a browser. The helper built a PowerShell command around the address without escaping it, so an address written to carry a PowerShell command would run that command.
The browser step runs only when a developer starts the sign-in, by running opencode mcp auth or making the matching request. Having the server configured, or opening a session, does not reach it.
The attacker needs control of a remote MCP server the developer has added, and that server need not be hostile from the start. One that is later taken over, or a domain that changes hands, could carry the same address.
Pillar Security, which found the flaw and disclosed it on October 19, rates it critical, with a proposed severity score of 9.8 out of 10.
The flaw affects OpenCode on Windows and the Windows Subsystem for Linux (WSL). macOS and Linux are not affected, because OpenCode opens the browser there without passing the address through a shell.
OpenCode shipped the fix as a routine change. The pull request that carried it is described as a refactor of browser-launch code, and neither it nor the release notes mention a security flaw.
Anomaly did not request a CVE or publish an advisory. Its security policy says MCP servers that a user configures are "outside our trust boundary."
Pillar reported the flaw privately on August 29 and later asked Anomaly to reconsider and request a CVE. Anomaly's answer was that a malicious MCP server falls outside its threat model, according to Pillar.
Because there is no CVE, the flaw will not show up in scanners or dependency alerts, so finding affected installs means checking the OpenCode version directly. Anomaly has published advisories for other OpenCode code-execution flaws this year, including one fixed in August.
The same kind of flaw has surfaced before. In July 2025, the mcp-remote proxy carried an almost identical bug, in which a malicious server's authorization endpoint reached the command line. It was assigned CVE-2025-6514.
OpenCode's browser helper is a widely used package called open. Its Windows behavior was reported as a command-injection risk in 2023 and fixed in open's version 11, but OpenCode stayed on an older release.
The usual defense for this class is to check that the address uses HTTP or HTTPS. It does not help here, because the attack uses an ordinary HTTPS address. OpenCode added that check as well, but the hole was closed by updating it to the fixed version.
What to Do
Anyone running OpenCode on Windows or WSL should upgrade and check which servers they are connected to.
- Upgrade to OpenCode 1.18.33 or later.
- If you cannot upgrade yet, remove any remote MCP servers you have not vetted from your OpenCode configuration.
- Run opencode mcp list to see which servers are configured.
Pillar reported no signs that the flaw has been used in attacks and published no indicators to check for past exploitation. The flaw is separate from a breach of OpenCode's hosted Console disclosed around the same time, which may have exposed some users' stored API keys for OpenAI, Anthropic, and Google.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.