Security · Updated 22 Oct, 04:14 pm IST
OpenCode flaw let malicious MCP servers execute code on Windows and WSL
Why it matters for readers: If you use OpenCode, install the patched version to stay safe from servers that could run code on your PC.
- OpenCode connects to external MCP (Model Context Protocol) servers to add outside tools, and that connection was the attack vector.1
- A malicious or compromised MCP server could execute code on a developer's machine when the developer signed in to OpenCode.1
- Executed code would run with the same access rights as the developer who signed in, increasing potential impact.1
- Anomaly released a fix in OpenCode version 1.18.33 in September to address the flaw.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started