{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2025-6514",
    "name": "CVE-2025-6514",
    "vendor": "opencode-ai",
    "description": "Pillar Security (Eilon Cohen) disclosed on 4 October 2026 a remote code execution flaw in opencode (opencode-ai on npm) on Windows and WSL. When a remote MCP server asks for authorization, the client runs OAuth discovery and opens the authorization_endpoint the server supplies in the browser. opencode 1.0.137 to 1.18.32 passed that string, with no scheme or origin check, to the open package pinned at 10.1.2, which on Windows builds a PowerShell -EncodedCommand line without escaping the target. PowerShell expands $(...) inside double-quoted strings, so an ordinary https:// URL carrying a subexpression runs code during the automatic handshake, with no prompt injection and no further user action. Scheme validation does not stop it, including the MCP TypeScript SDK's javascript:/data:/vbscript: denylist and the scheme check opencode itself added; what closed it was upgrading open to 11.0.4, which single-quotes the target. Pillar reported privately on 29 August. The fix (PR 51414, released in 1.18.33 on 28 September) shipped as a refactor, and the vendor, Anomaly, published no advisory and requested no CVE, saying malicious MCP servers are outside its threat model, so scanners and dependency bots will not flag affected installs. A server that was harmless when configured can deliver the payload later, after a compromise, a hijacked registry entry or an expired domain. macOS and Linux are not affected. Pillar proposes CVSS 3.1 9.8; the defect class is the same as CVE-2025-6514 in mcp-remote.",
    "website": "https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "unknown",
      "packageName": "opencode-ai",
      "command": null
    },
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-10-04",
    "risk": {
      "score": 98,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2025-6514",
      "aliases": [
        "ti-140"
      ],
      "title": "opencode on Windows and WSL: A Remote MCP Server's OAuth authorization_endpoint Ran PowerShell on Connect, Fixed Quietly in 1.18.33 With No Advisory or CVE",
      "summary": "Pillar Security (Eilon Cohen) disclosed on 4 October 2026 a remote code execution flaw in opencode (opencode-ai on npm) on Windows and WSL. When a remote MCP server asks for authorization, the client runs OAuth discovery and opens the authorization_endpoint the server supplies in the browser. opencode 1.0.137 to 1.18.32 passed that string, with no scheme or origin check, to the open package pinned at 10.1.2, which on Windows builds a PowerShell -EncodedCommand line without escaping the target. PowerShell expands $(...) inside double-quoted strings, so an ordinary https:// URL carrying a subexpression runs code during the automatic handshake, with no prompt injection and no further user action. Scheme validation does not stop it, including the MCP TypeScript SDK's javascript:/data:/vbscript: denylist and the scheme check opencode itself added; what closed it was upgrading open to 11.0.4, which single-quotes the target. Pillar reported privately on 29 August. The fix (PR 51414, released in 1.18.33 on 28 September) shipped as a refactor, and the vendor, Anomaly, published no advisory and requested no CVE, saying malicious MCP servers are outside its threat model, so scanners and dependency bots will not flag affected installs. A server that was harmless when configured can deliver the payload later, after a compromise, a hijacked registry entry or an expired domain. macOS and Linux are not affected. Pillar proposes CVSS 3.1 9.8; the defect class is the same as CVE-2025-6514 in mcp-remote.",
      "severity": "critical",
      "cvss": {
        "score": 9.8,
        "vector": null,
        "version": "3.1"
      },
      "cwe": [],
      "attackType": [
        "Remote code execution",
        "Command injection"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "opencode-ai",
        "vendor": null,
        "package": "opencode-ai",
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": ">=1.0.137 <1.18.33",
          "fixed": "1.18.33"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-04",
      "modifiedAt": "2026-10-04",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6514"
        }
      ],
      "mitigation": "Upgrade opencode to 1.18.33 or later (1.19.3 was current on 19 October 2026) on every Windows and WSL machine, and inventory installs directly, because there is no CVE for scanners to match. Until a machine is upgraded, remove remote MCP servers you have not vetted from its opencode config. If you build an MCP client, launch the browser with an argument vector rather than a shell command line, use open 11.x or later, and bind OAuth discovery to the origin of the configured server; a scheme allowlist on its own is not enough.",
      "detectedByAnomity": true
    }
  }
}