Researchers at Pillar Security have warned that the open-source agentic AI coding tool OpenCode, with over 218,000 GitHub stars, silently patched a critical remote code execution (RCE) vulnerability, leaving users unaware of the risk.
The vulnerability or weakness
A critical RCE vulnerability affecting OpenCode versions 1.0.137 to 1.18.32 was discovered, impacting Windows and Windows Subsystem for Linux (WSL). The vulnerability could allow attackers to execute arbitrary code during an MCP OAuth authentication process.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations using OpenCode could face significant operational risks if the vulnerability is exploited, potentially leading to data breaches or system compromise. This could result in financial losses and damage to reputation.
Industries affected
This incident affects software development firms, tech companies, and organizations that rely on automated coding tools.
Users affected
Developers and organizations using OpenCode are at risk, as the silent patch means they may remain unaware of the vulnerability, leaving their systems potentially exposed to remote code execution attacks.
Build these skills
Watch the daily brief
Sources
- Researchers Warn OpenCode Quietly Patched Critical RCE Flaw, Leaving Users At Risk (Infosecurity Magazine)
