The debugging client trusted the server long enough to open a URL. That was the whole exploit.
Through late October 2026, remote MCP OAuth discovery turned into local shell on developer laptops running OpenCode or MCP Inspector, without a model call and without a tool approval prompt.
authorization_endpoint becomes PowerShell; callback query becomes stdio
A remote MCP server answers 401, serves OAuth discovery, and chooses authorization_endpoint. In opencode-ai 1.0.137 through 1.18.32 and @modelcontextprotocol/inspector 2.0.0 through 2.11.0 on Windows and WSL, that string reached open@10.x. The package wrapped the target in double quotes inside a base64-encoded PowerShell command. PowerShell evaluates $(...) before Start runs, and WHATWG URL serialisation preserves the characters a payload needs. Scheme allowlists for http: and https: do not stop it.
Corgea’s 29 October write-up and Pillar’s Inspector follow-on track the same sink. NVD published CVE-2026-119025 for open >=7.2.0,<11.0.0, naming OpenCode and Inspector in the affected-product set.
Inspector carried a second path. GHSA-4fc4-wcmh-4g86 (CVSS 9.6) covered Inspector and inspector-client 0.13.0 through 1.0.2: an attacker-controlled authorize redirect could append transport=stdio, serverCommand, and serverArgs to /oauth/callback. The callback page initialised connection state from those query parameters and spawned a local stdio process after token exchange. That chain is OS-general, unlike the PowerShell-only opener sink.
A working payload looks like a normal https URL. Corgea’s reproduction string writes a canary file through [IO.File]::WriteAllText inside $(...), survives URL serialisation, and runs while the browser launch itself may still fail. The subexpression is evaluated before Start resolves.
Operators who only patched MCP servers still had a laptop hole
Published MCP command-injection work in October centred on server-side shell tools. This pair is client and developer-tooling RCE during connect. Teams that tightened server packages while leaving Windows OpenCode installs on 1.18.32, or Inspector below 2.12.0, kept the hole that fires before tools/list.
Inspector’s design makes the population sharper. The tool exists to examine servers you do not yet trust. Auto-open in the CLI is on unless MCP_AUTO_OPEN_ENABLED=false, so the PowerShell chain can fire on first 401 in an interactive terminal. Amazon, Cloudflare, and Microsoft documentation that point developers at Inspector for remote-server testing widen the exposed set beyond hobby installs.
Fixed packages, shared CVE, still-lagging open downloads
Fixes landed as opencode-ai 1.18.33 (open bumped to 11.0.4), Inspector 2.12.0 for the v2 PowerShell advisory, and Inspector 1.0.3 for the v1 callback advisory. open itself fixed target escaping in 11.0.0. Maturity: patch-now on Windows and WSL developer endpoints; treat any agent CLI that still resolves open@10.x as suspect even when the product changelog is quiet.
Pillar’s later note flagged that most weekly open downloads still resolved to affected majors around early November, and that caret ranges on 10.x never float to 11.x without an override.
Patch the laptop tools even if your MCP servers look clean
Upgrade OpenCode to 1.18.33 or later, Inspector to 2.12.0 or 1.0.3, and force open@11 through overrides wherever a lockfile still pins 10.x. Inventory developer workstations with opencode --version and npm ls open, because OpenCode’s fix initially shipped without its own CVE.
If your programme only tracks server CVEs from the nine-command-injection batch, add client OAuth URL handling to the same Monday checklist. macOS and native Linux avoid the open@10 PowerShell branch, yet still need the Inspector callback fix on older v1 lines.
Scheme filters and “remote means safe” both fail closed the wrong way
http(s)-only checks give false comfort when the sink is PowerShell string expansion. Assuming remote HTTP MCP cannot execute locally ignores both the opener path and the callback-to-stdio flip. Domain takeover or a later-compromised registry entry delivers the same authorization_endpoint without a malicious install-time package.
Scanners that miss OpenCode because it lacked a product CVE will also miss transitive open@10.x inside unrelated CLIs. Grep lockfiles for open and for inspector packages, not only for CVE-2026-119025 hits.
Treat remote MCP connect as code execution surface on the laptop
The Monday move is boring and local: bump OpenCode, Inspector, and open, then keep remote MCP OAuth against untrusted hosts off Windows CI images until the lockfile proves 11.x. Server hardening remains necessary; it is no longer sufficient for the developer endpoint.