opencode on Windows: A Malicious MCP Server's OAuth Endpoint Runs PowerShell Code on Connect

`opencode-ai` 1.0.137 through 1.18.32 on Windows and WSL

Pillar Security found that a remote MCP server could return an `authorization_endpoint` during OAuth discovery that opencode passed unvalidated to the `open` package. On Windows, `open` 10.1.2 built a PowerShell `-EncodedCommand` without escaping, so a `$(...)` inside an ordinary `https://` URL ran as code. Fixed in 1.18.33 (September 28, 2026) as a refactor with no advisory or CVE; Anomaly said malicious MCP servers are outside its threat model. Pillar proposes CVSS 9.8. Single source

Server-supplied OAuth URLs handed to an OS launcher without scheme checks or escaping