OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
Publié le
Par The Hacker News
OPENCODE FLAW LETS MALICIOUS MCP SERVERS EXECUTE CODE DURING SIGN-IN ON WINDOWS AND WSL
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access.
IMPACTS POUR LES ORGANISATIONS
- ▸Non-conformité réglementaire exposant à des sanctions financières.
- ▸Atteinte à la réputation et perte de confiance des parties prenantes.
- ▸Obligation de mise en conformité sous contrainte de délais.
▶ ÉVALUATION DE LA CONFORMITÉ ET MISE EN PLACE DES MESURES CORRECTIVES
Source : The Hacker News
SECURITRUST
Source
Article original publié par The Hacker News : OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL