Pillar Security discloses critical RCE flaw in OpenCode

Pillar Security researchers disclosed a CVSS 9.8 RCE vulnerability in OpenCode versions 1.0.137–1.18.32 on Windows and WSL, where a malicious MCP server could execute code during OAuth authentication. Anomaly patched it on September 28 in version 1.18.33 without a CVE or security advisory.

• Flaw affects OpenCode 1.0.137–1.18.32 on Windows and WSL
• Rated CVSS 9.8, requires no user interaction to exploit
• Patch shipped September 28 in 1.18.33 without a CVE or advisory
• Standard vulnerability scanners won't flag affected installs