7.7 Élevée

CVE-2026-119025 open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code…

Description

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
open 7.2	7.2.0 → < 11.0.0	11.0.0
inspector 2.0	2.0.0 → < 2.12.0	2.12.0
opencode 1.0	1.0.137 → < 1.18.33	1.18.33

Références

Patch Commit github.com
open v11.0.0 Release Notes github.com
github.com github.com
github.com github.com
GitHub Security Advisory (GHSA-q978-78c7-phqw) github.com
opencode Pull Request #51414 github.com
opencode Patch Commit github.com
VulnCheck Advisory: open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows www.vulncheck.com

Chronologie

Publiée 29 octobre 2026
Dernière modification 3 novembre 2026

Suivre cette CVE