p PatchFirst

CVE-2026-119025

CVE-2026-119025 · open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows

This page contains facts from public vulnerability sources. Check the original advisory before updating.

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.

CVSS 7.7 · High · EPSS 1.4% · Public exploit · Fix available

Published
Updated

Affected products and versions

  • open

    Versions
    • ≥ 7.2.0, < 11.0.0: Affected (semver)

    Update to 11.0.0

  • inspector

    Versions
    • ≥ 2.0.0, < 2.12.0: Affected (semver)

    Update to 2.12.0

  • opencode

    Versions
    • ≥ 1.0.137, < 1.18.33: Affected (semver)

    Update to 1.18.33

Original sources

Check your server →