OpenCode flaw let malicious MCP servers run code on Windows
A hijacked remote MCP server could run PowerShell on a developer's machine during OpenCode sign-in on Windows/WSL. No CVE; fixed silently in 1.18.33. Pillar Security disclosed it October 19.