{
 "schema_version": "1.0",
 "generated_at": "2026-11-07T18:30:10Z",
 "last_checked": "2026-11-07T17:33:08+00:00",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "product": {
  "slug": "opencode",
  "name": "OpenCode",
  "short_name": "OpenCode",
  "page_url": "https://patchgap.ai/is-my-opencode-up-to-date/",
  "minimum_safe_version": "1.18.33",
  "minimum_safe_version_source": [
   {
    "url": "https://github.com/anomalyco/opencode/releases/tag/v1.18.33",
    "title": "OpenCode release v1.18.33",
    "date": "2026-09-28",
    "kind": "vendor"
   }
  ],
  "baseline": {
   "version": "1.18.33",
   "applies_to": "all platforms listed for this product",
   "source_incident": "opencode-windows-sign-in-code-run",
   "sources": [
    {
     "url": "https://github.com/anomalyco/opencode/releases/tag/v1.18.33",
     "title": "OpenCode release v1.18.33",
     "date": "2026-09-28",
     "kind": "vendor"
    }
   ],
   "covers_everything_listed": true,
   "caveats": [],
   "text": "You're covered against everything listed here if you're on OpenCode 1.18.33 or newer."
  },
  "update_steps": {
   "windows": [
    "Use OpenCode's own upgrade command, or download the newest release from its official GitHub page."
   ],
   "macos": [
    "Use OpenCode's own upgrade command, or download the newest release from its official GitHub page."
   ],
   "linux": [
    "Use OpenCode's own upgrade command, or download the newest release from its official GitHub page."
   ]
  },
  "last_checked": "2026-11-07T17:33:08+00:00",
  "vendor": "Anomaly",
  "category": "ai",
  "platforms": [
   "windows",
   "macos",
   "linux"
  ],
  "what_it_is": "An open-source AI helper that works inside a computer's command line to write and change code.",
  "url": "https://patchgap.ai/is-my-opencode-up-to-date/",
  "json_url": "https://patchgap.ai/products/opencode.json",
  "official_site": "https://opencode.ai",
  "official_download": "https://github.com/anomalyco/opencode/releases",
  "how_it_updates": "Run OpenCode's upgrade command, or download the newest release from the official GitHub page.",
  "check": {
   "windows": {
    "menu_path": "Open PowerShell and type the command below.",
    "command": "opencode --version",
    "shell": "PowerShell",
    "read_only": true
   },
   "macos": {
    "menu_path": "Open Terminal and type the command below.",
    "command": "opencode --version",
    "shell": "Terminal",
    "read_only": true
   },
   "linux": {
    "menu_path": "Open Terminal and type the command below.",
    "command": "opencode --version",
    "shell": "Terminal",
    "read_only": true
   }
  },
  "open_incidents": [
   "opencode-windows-sign-in-code-run"
  ]
 },
 "incidents": [
  {
   "id": "opencode-windows-sign-in-code-run",
   "url": "https://patchgap.ai/incidents/opencode-windows-sign-in-code-run/",
   "path": "/incidents/opencode-windows-sign-in-code-run/",
   "json_url": "https://patchgap.ai/incidents/opencode-windows-sign-in-code-run.json",
   "title": "OpenCode AI helper on Windows: a bad connected tool could run code when you sign in",
   "category": "ai",
   "platforms": [
    "windows"
   ],
   "products": [
    "opencode"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "critical",
   "severity_source": "Proposed 9.8 by the researchers at Pillar Security. There is no official score.",
   "exploited_in_wild": "no",
   "exploited_note": "No report that anyone has used this bug.",
   "exploited_source_url": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html",
   "confidence": "unconfirmed",
   "confidence_note": "OpenCode's makers did not publish a security notice or a CVE. The fix version comes from the researchers' report and the project's release page, which does not mention a security fix.",
   "first_reported": "2026-10-19",
   "updated_at": "2026-10-27",
   "cves": [],
   "summary": "OpenCode is an AI helper that works with code. It can connect to outside tools (called MCP servers). On Windows and in WSL, a bad or hijacked tool could make OpenCode run a command on your computer when you start a sign-in to that tool. News reports say version 1.18.33 fixes it, but OpenCode's makers did not announce it.",
   "am_i_affected": "You may be at risk if you use OpenCode on Windows (or in WSL) between version 1.0.137 and 1.18.32 and you connect it to outside tools that need sign-in. Mac and Linux are not affected, according to the report.",
   "action": "Update OpenCode to 1.18.33",
   "affected": [
    {
     "product": "opencode",
     "product_name": "OpenCode",
     "platform": "windows",
     "affected_versions": "OpenCode 1.0.137 to 1.18.32 on Windows and WSL (per researchers)",
     "fixed_version": "1.18.33",
     "fixed_min": "1.18.33",
     "fix_note": null,
     "fixed_source_urls": [
      "https://github.com/anomalyco/opencode/releases/tag/v1.18.33"
     ],
     "check": {
      "menu_path": "Open PowerShell and type the command below.",
      "command": "opencode --version",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://github.com/anomalyco/opencode/releases"
    }
   ],
   "fix_steps": [
    "Update OpenCode to 1.18.33 or newer.",
    "Check that opencode --version shows the new version.",
    "Only connect OpenCode to outside tools you trust. Do not start a sign-in to a tool you do not trust."
   ],
   "official_patch_links": [
    {
     "label": "OpenCode releases (official GitHub)",
     "url": "https://github.com/anomalyco/opencode/releases/tag/v1.18.33"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://github.com/anomalyco/opencode/releases/tag/v1.18.33",
     "title": "OpenCode release v1.18.33",
     "date": "2026-09-28",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html",
     "title": "The Hacker News: OpenCode flaw lets malicious MCP servers run code on Windows and WSL",
     "date": "2026-10-22",
     "kind": "press",
     "official": false
    }
   ]
  }
 ]
}