CVE-2026-119025: open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows
open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorizationendpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.
Affected Software
Event History
Frequently Asked Questions
Which environments are affected?
The issue affects npm/open versions from 7.2.0 before 11.0.0 when used on Windows or WSL. Other operating systems are not identified as affected in the available information.
What must an attacker control to exploit this?
An attacker needs to supply a crafted URL that is processed by the affected package. One identified route is a malicious MCP server providing an OAuth authorization_endpoint value containing a PowerShell $(...) subexpression.
What can be done before upgrading?
Avoid passing untrusted URLs to the affected package, especially OAuth authorization_endpoint values or URLs obtained from untrusted MCP servers. Upgrade to version 11.0.0 when possible.
How can I determine whether an application is exposed?
Check whether the application depends on npm/open in the affected version range and runs its URL-opening functionality on Windows or WSL. Review whether URLs passed to open can originate from untrusted external sources.