Tag: OpenCode

OpenCode shipped the fix but left scanners with nothing to see

Builds 1.0.137 through 1.18.32 can run a command from a malicious MCP server at sign-in, and no CVE was filed…