CVE-2026-119025

open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows

State: Published
Severity: 7.7 High
Published: Oct 29, 2026
Updated: Oct 29, 2026
Reserved: Oct 29, 2026

Description

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.

Scores

CVSS	Score	Vector	Source
4.0	7.7 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	7.5 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
opensindresorhus	7.2.0 to before 11.0.0Affected
inspectormodelcontextprotocol	2.0.0 to before 2.12.0Affected
opencodeanomalyco	1.0.137 to before 1.18.33Affected

References

Patch Commitpatch
open v11.0.0 Release Notesrelease-notes
https://github.com/sindresorhus/open/blob/v10.2.0/index.js#L189-L203technical-description
https://github.com/sindresorhus/open/blob/v7.2.0/index.js#L60-L99technical-description
GitHub Security Advisory (GHSA-q978-78c7-phqw)vendor-advisory
opencode Pull Request #51414patchissue-tracking
opencode Patch Commitpatch
VulnCheck Advisory: open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windowsthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.