Anomaly Patches Critical OpenCode Flaw
The software update addresses a remote code execution vulnerability found in versions 1.0.137 through 1.18.32.
Updated on Oct. 20, 2026 in Software
Live Poll
Should software companies be required to issue public security advisories for every critical vulnerability patch?
Anomaly released a patch on September 28, 2026, for the open-source platform OpenCode to address a critical remote code execution vulnerability. The flaw, which carried a CVSS severity rating of 9.8, allowed remote model context protocol servers to execute arbitrary code.
Why it matters
The vulnerability existed because older versions of the software failed to implement proper URL scheme checks or dependency quoting, leaving developer machines exposed. Because conventional scanners cannot detect the issue, manual updates are necessary to secure affected systems.
The vulnerability, which impacted OpenCode versions 1.0.137 to 1.18.32 on Windows and Windows Subsystem for Linux, stemmed from passing URLs to PowerShell without proper escaping. OpenCode currently holds 218,000 stars on GitHub.
The players
Anomaly
Anomaly is the organization responsible for developing and maintaining the open-source software project OpenCode.
Pillar Security
Pillar Security is a firm that performs vulnerability research and reported the security flaw to the OpenCode maintainers.
The details
Malicious actors could embed payloads in legitimate HTTPS URLs to bypass scheme validation and trigger the execution of code. Developers are now urged to shift toward argument-based process execution rather than passing untrusted URLs through shell commands.
Timeline
August 2026: Pillar Security privately reported the vulnerability to OpenCode.
September 28, 2026: Anomaly released the patch in version 1.18.33.
October 19, 2026: Pillar Security publicly disclosed the vulnerability.
The Tech Race
This vulnerability highlights the ongoing challenge of securing developer environments against complex supply chain attacks. It mirrors the broader industry shift toward prioritizing secure-by-design coding practices to replace legacy shell-execution methods.
Developers running affected versions on Windows or Windows Subsystem for Linux should update to version 1.18.33 immediately to prevent potential remote code execution. Since traditional vulnerability scanners will not alert users to this specific flaw, manual verification of the software version is required.
The takeaway
Users should treat input data from external sources as potentially malicious and avoid passing raw URLs through shell commands. Relying on automated scanners is insufficient for detecting these types of logic-based security flaws.
Further reading
Learn more about the latest developments in the Software industry.
Live Poll
Should software companies be required to issue public security advisories for every critical vulnerability patch?
