{"id":"CVE-2026-119025","kind":"vulnerability","aliases":["CVE-2026-119025"],"related":[],"title":"open npm package: crafted URLs run PowerShell commands on Windows","description":"open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.","summary":"The npm package open, versions 7.2.0 up to 11.0.0, passes URLs to PowerShell without escaping them. An attacker who supplies a URL containing $(...) subexpressions, such as an OAuth endpoint from a malicious MCP server, can run PowerShell code on Windows and WSL.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mcp","npm","open","package","windows","wsl"],"not_affected_if":["non-windows-runtime","trusted-urls-only","version-outside-7.2.0-to-11.0.0"],"how_to_check":"- Run `npm ls open` in each project and check whether any copy resolves to a version from `7.2.0` up to, but not including, `11.0.0`.\n- Check `package-lock.json`, `pnpm-lock.yaml` or `yarn.lock` for `open` versions in that range, including transitive dependencies.\n- Note whether the application runs on Windows or WSL and passes externally supplied URLs to `open`.","fix":"- open (npm): upgrade to `11.0.0` or later.","status":"open","published_at":"2026-10-29T12:17:12+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","triaged_at":"2026-10-29T12:25:36+00:00","updated_at":"2026-10-29T12:25:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T12:25:36Z","model":"claude-haiku-5-5","output":{"fix":"- open (npm): upgrade to `11.0.0` or later.","reach":"unknown","title":"open npm package: crafted URLs run PowerShell commands on Windows","impact":"high","summary":"The npm package open, versions 7.2.0 up to 11.0.0, passes URLs to PowerShell without escaping them. An attacker who supplies a URL containing $(...) subexpressions, such as an OAuth endpoint from a malicious MCP server, can run PowerShell code on Windows and WSL.","audience":"developers","category":"package","nicknames":[],"who_cares":["open","npm","windows","wsl","mcp"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs arbitrary PowerShell code on the Windows or WSL machine","analyst_note":"","how_to_check":"- Run `npm ls open` in each project and check whether any copy resolves to a version from `7.2.0` up to, but not including, `11.0.0`.\n- Check `package-lock.json`, `pnpm-lock.yaml` or `yarn.lock` for `open` versions in that range, including transitive dependencies.\n- Note whether the application runs on Windows or WSL and passes externally supplied URLs to `open`.","plain_action":"","needs_analyst":false,"not_affected_if":["version-outside-7.2.0-to-11.0.0","non-windows-runtime","trusted-urls-only"],"who_is_affected":"Applications that depend on the npm package open between 7.2.0 and 11.0.0 and run on Windows or WSL are exposed, especially when they open URLs that come from outside, such as OAuth endpoints returned by MCP servers. Projects that only open trusted fixed URLs, run on Linux or macOS, or do not ship the affected version can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001179,"input_tokens":4167,"output_tokens":1524,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119025':13A,16A '-2026':12A,15A '11.0.0':31B,68C '7.2.0':28B,66C 'allow':76C 'attack':40B,77C,90C 'author':99C 'code':60B,81C 'command':8A,72C 'contain':45B,69C 'craft':4A,84C 'cve':11A,14A 'emb':92C 'encodedcommand':115C 'endpoint':51B,100C 'escap':37B 'execut':79C,107C 'index.js':109C 'inject':73C 'malici':54B,103C 'mcp':17B,55B,104C 'npm':2A,18B,24B 'oauth':50B,98C 'open':1A,19B,26B,65C 'os':71C 'packag':3A,20B,25B 'pass':32B,110C 'powershel':7A,35B,59B,80C,114C 'run':6A,58B 'server':56B,105C 'subexpress':46B,93C 'suppli':42B,83C 'unescap':112C 'url':5A,33B,44B,85C,95C 'valu':101C 'version':27B 'vulner':74C 'window':10A,21B,62B,87C 'without':36B 'wsl':22B,64B,89C","nicknames":[],"mitigations":[],"who_affected":"Applications that depend on the npm package open between 7.2.0 and 11.0.0 and run on Windows or WSL are exposed, especially when they open URLs that come from outside, such as OAuth endpoints returned by MCP servers. Projects that only open trusted fixed URLs, run on Linux or macOS, or do not ship the affected version can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T12:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119025","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119025","severity":null,"published_at":"2026-10-29T12:17:12+00:00","modified_at":"2026-10-29T12:17:12+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","fetched_at":"2026-10-29T12:24:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}