{"slug": "opencode-flaw-enables-code-execution-via-malicious-mcp-servers", "title": "OpenCode Flaw Enables Code Execution via Malicious MCP Servers", "summary": "A critical vulnerability rated 9.8/10 in OpenCode's MCP sign-in flow allows malicious MCP servers to execute code on users' machines, according to a disclosure that was privately reported on August 29 and made public on October 19. A fix shipped in OpenCode version 1.18.33 on September 28. The flaw matters because MCP servers are widely used to connect AI coding agents to external tools, so a malicious server can turn a routine sign-in into arbitrary code execution.", "body_md": "A critical flaw in OpenCode's MCP sign-in flow, rated 9.8/10 in severity, allows malicious MCP servers to execute code, posing a significant threat to users. This vulnerability was privately reported on August 29 and publicly disclosed on October 19, with a fix released in version 1.18.33 on September 28.", "url": "https://wpnews.pro/news/opencode-flaw-enables-code-execution-via-malicious-mcp-servers", "canonical_source": "https://osintsights.com/opencode-flaw-enables-code-execution-via-malicious-mcp-servers", "published_at": "2026-10-22 11:21:47+00:00", "updated_at": "2026-10-22 11:40:46.629901+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "agent-protocols", "developer-tools", "ai-tools"], "entities": ["OpenCode", "MCP"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/opencode-flaw-enables-code-execution-via-malicious-mcp-servers", "markdown": "https://wpnews.pro/news/opencode-flaw-enables-code-execution-via-malicious-mcp-servers.md", "text": "https://wpnews.pro/news/opencode-flaw-enables-code-execution-via-malicious-mcp-servers.txt", "jsonld": "https://wpnews.pro/news/opencode-flaw-enables-code-execution-via-malicious-mcp-servers.jsonld"}}