---
id: "CVE-2026-119025"
kind: "vulnerability"
aliases: ["CVE-2026-119025"]
title: "open npm package: crafted URLs run PowerShell commands on Windows"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mcp", "npm", "open", "package", "windows", "wsl"]
not_affected_if: ["non-windows-runtime", "trusted-urls-only", "version-outside-7.2.0-to-11.0.0"]
published_at: "2026-10-29T12:17:12+00:00"
first_seen_at: "2026-10-29T12:24:38+00:00"
updated_at: "2026-10-29T12:25:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119025", "first_seen_at": "2026-10-29T12:24:38+00:00"}]
---

# open npm package: crafted URLs run PowerShell commands on Windows

The npm package open, versions 7.2.0 up to 11.0.0, passes URLs to PowerShell without escaping them. An attacker who supplies a URL containing $(...) subexpressions, such as an OAuth endpoint from a malicious MCP server, can run PowerShell code on Windows and WSL.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `npm ls open` in each project and check whether any copy resolves to a version from `7.2.0` up to, but not including, `11.0.0`.
- Check `package-lock.json`, `pnpm-lock.yaml` or `yarn.lock` for `open` versions in that range, including transitive dependencies.
- Note whether the application runs on Windows or WSL and passes externally supplied URLs to `open`.

## Fix

- open (npm): upgrade to `11.0.0` or later.

## Timeline

- 2026-10-29T12:24:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119025

## From the sources

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_