Threats affecting pkg:npm/opencode

open versions from 7.2.0 up to but not including 11.0.0 contain an OS command injection vulnerability on Windows and WSL. This flaw allows attackers to execute arbitrary PowerShell commands by supplying specially crafted URLs that include $(...) subexpressions. The vulnerability arises because these URLs are passed unescaped to powershell -EncodedCommand in index.js, enabling code execution. Fixed versions are 11.0.0 and later.