CVE-2026-119025
highopen 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows a…
open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/anomalyco/opencode/commit/29f07e0c69ad8668e0e15b0eb54f2fcb342af98c disclosure@vulncheck.com
- https://github.com/anomalyco/opencode/pull/51414 disclosure@vulncheck.com
- https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-q978-78c7-phqw disclosure@vulncheck.com
- https://github.com/sindresorhus/open/blob/v10.2.0/index.js#L189-L203 disclosure@vulncheck.com
- https://github.com/sindresorhus/open/blob/v7.2.0/index.js#L60-L99 disclosure@vulncheck.com
- https://github.com/sindresorhus/open/commit/274d70446bf38a7b7d50b214dd3962ef8ea9320d disclosure@vulncheck.com
- https://github.com/sindresorhus/open/releases/tag/v11.0.0 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/open-7.2.0-before-11.0.0-os-command-injection-via-pow... disclosure@vulncheck.com