CVE-2026-119025 in open
Summary
by MITRE • 10/29/2026
open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in Open versions prior to 11.0.0 represents a critical OS command injection flaw that specifically impacts Windows and WSL environments where PowerShell is the default shell interpreter. This security defect arises from improper neutralization of special elements used in operating system commands, allowing an attacker to inject arbitrary code into the execution pipeline. The core technical failure lies within the index.js module, which processes URLs provided by external sources without adequate sanitization or escaping before passing them as arguments to the powershell -EncodedCommand utility. By embedding malicious subexpressions such as $(...) directly into URL parameters like OAuth authorization_endpoint values from untrusted Model Context Protocol servers, an attacker can bypass intended application logic and achieve remote code execution with the privileges of the running process.
From a technical perspective, this vulnerability exploits the way PowerShell handles encoded command strings when invoked via standard input or arguments. When index.js passes these crafted URLs to powershell -EncodedCommand without proper validation, it effectively allows for arbitrary script block injection. The use of subexpression operators like $(...) enables complex logic execution within the injected payload, potentially leading to data exfiltration, lateral movement across networked systems, or complete system compromise depending on the context in which Open is deployed. This flaw aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and reflects common pitfalls in applications that interface directly with shell interpreters without robust input validation layers.
The operational impact of this vulnerability is severe due to its potential for remote exploitation through web-based interactions involving OAuth flows or similar authentication mechanisms integrated via MCP servers. Attackers can leverage maliciously configured authorization endpoints to trigger command execution simply by directing a user's browser or application client to process the crafted URL. This could result in unauthorized access to sensitive data, installation of persistent backdoors, or disruption of services running under elevated privileges if Open is executed with administrative rights. The reliance on PowerShell encoding further complicates detection efforts since encoded commands appear as opaque strings until decoded and executed by the shell environment.
Mitigation strategies should prioritize immediate upgrading to version 11.0.0 or later where this issue has been addressed through improved input handling mechanisms. In cases where upgrade is not immediately feasible, implementing strict allowlisting of permitted URL schemes and domains can reduce exposure risk significantly. Additionally developers must ensure that any data passed to shell commands undergoes rigorous validation using established libraries designed for safe command construction rather than manual string concatenation or interpolation. Security teams should also monitor system logs for unusual PowerShell activity patterns indicative of encoded command execution originating from web application contexts as part of ongoing threat hunting efforts aligned with MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse.