Get the app
CybersecurityDev4 min reading time

OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

The Hacker News
Read the full article
A critical vulnerability in OpenCode's AI coding agent allowed malicious MCP servers to execute code on Windows and WSL machines during user sign-in. The flaw was fixed in version 1.18.33 but remains unflagged by scanners due to no CVE issuance. The issue stems from unescaped PowerShell commands triggered by malicious authorization endpoints controlled by compromised MCP servers.
#anomaly#mcp#opencode#powershell#software-security#vulnerability-management#windows-subsystem-for-linux

More in Cybersecurity

Cybersecurity5 min read

What is PHP and why did it spark a global cyber-security scramble?

Covered by 3 sources
Cybersecurity5 min read

Why governments pulled websites offline over the decades-old PHP programming language

Covered by 3 sources
Cybersecurity3 min read

Nvidia turns OpenShell into a full hardware stack for safe AI agents

Covered by 2 sources