This isn't remotely funny. The research was posted yesterday:
Pillar Security: Open and Shut: Remote Code Execution in opencode via MCP OAuth https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth
More:
Infosecurity-Magazine: Researchers Warn OpenCode Quietly Patched Critical RCE Flaw, Leaving Users At Risk https://www.infosecurity-magazine.com/news/opencode-quietly-patched-critical/ #infosec #vulnerability #bots #GitHub
www.pillar.securityOpen and Shut: Remote Code Execution in opencode via MCP OAuthPillar Security found a critical remote code execution flaw in opencode on Windows and WSL. A remote MCP server could run code on your machine during the OAuth handshake. Affected 1.0.137 to 1.18.32, fixed in 1.18.33, no CVE issued.