// OpenaiHIGH
OpenCode silently patched a critical remote code execution (RCE) vulnerability on September 28, 2026 in versions 1.0.137 to 1.18.32, affecting Windows and Windows Subsystem for Linux users. Researchers at Pillar Security disclosed the flaw on October 19, warning that malicious MCP servers could execute arbitrary code during OAuth authentication without additional user interaction. The silent patch leaves vulnerable deployments undetected by conventional vulnerability scanners. Pillar Security assessed the vulnerability at CVSS 9.8 critical severity.
// Get alerts for Openai