Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2026-119025 EUVD-2026-112744GHSA-jgwm-4pmq-r4w4

open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows

Published Oct 29, 2026 · Updated Nov 3, 2026 · Assigned by VulnCheck

Vendor: anomalyco Vendor: Model Context Protocol Vendor: sindresorhus Product: inspector Product: open Product: opencode Package: node-open Package: python-tensorboard Ecosystem: Azure Linux Ecosystem: Ubuntu

Description

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.

Affected products

VendorProductAffectedFixed
sindresorhus open 7.2.0 – < 11.0.0 11.0.0
modelcontextprotocol inspector 2.0.0 – < 2.12.0 2.12.0
anomalyco opencode 1.0.137 – < 1.18.33 1.18.33

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 node-open No fix yet —
Ubuntu 26.04 LTS node-open No fix yet —
Ubuntu 24.04 LTS node-open No fix yet —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-tensorboard No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • shouvikkkk/oauth-sink-check ★ 0 · Oct 30, 2026

    Trace untrusted OAuth endpoint URLs from source to shell sink — the CVE-2026-119025 attack class, checked in your code, lockfile and MCP configs.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References