command-injection

Oct 20, 2026 4 min read

OpenCode Silently Patched an MCP OAuth Flaw That Ran Code on Windows

Pillar Security says a malicious MCP server could run commands on Windows developer machines through OpenCode's OAuth flow. The fix shipped in 1.18.33. No CVE or public advisory found as of Oct 20.

img of PraisonAI Flaws Exploited Hours After Disclosure: Auth Bypass to RCE

Jul 8, 2026 5 min read

Vulnerabilities

PraisonAI Flaws Exploited Hours After Disclosure: Auth Bypass to RCE

Nine vulnerabilities including a hardcoded authentication bypass and critical MCP command injection were disclosed in PraisonAI, with scanners targeting the auth bypass endpoint less than four hours after the advisory went public.