On September 28, Anvil shipped version 1.18.33 of OpenCode, its AI coding agent, closing a code execution hole. It requested no CVE and posted no advisory, which leaves vulnerability feeds with nothing to match against the copies still open on developer machines.
The unpatched range runs from 1.0.137 up to and including 1.18.32. Point a package scanner at it and the answer comes back clean.
What the address does
OpenCode borrows outside tools by talking to MCP servers. At sign-in, a server hands over the authorization endpoint where the user should be sent, and on Windows and WSL the agent passed that string to a helper that launched it in a browser. The helper built a PowerShell command around it without escaping, so an address crafted to carry a command executed instead.
The exposure is tighter than it first appears. Those steps run only when a developer kicks off the sign-in through opencode mcp auth or an equivalent request. Merely having a server configured is not enough. The attacker must control a remote MCP server the developer added, and it need not have been hostile at install time. A takeover or lapsed domain later suffices, so trust extended months ago can still turn.
