OpenCode silently patched critical RCE in MCP OAuth flow on Windows/WSL (v1.0.137-1.18.32), no CVE issued
Pillar Security researcher Eilon Cohen disclosed on October 19 a critical remote code execution flaw in the open-source agentic AI coding tool OpenCode (developed by Anomaly), affecting versions 1.0.137 to 1.18.32 on Windows and WSL. A malicious remote MCP server can execute arbitrary code on a developer's machine during the MCP OAuth aut…