High severity · published Oct 29, 2026
CVE-2026-119025
open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows
New
7.5
CVSS
–
EPSS
No
On KEV
Description
open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
inspector · modelcontextprotocol
2.0.0 before 2.12.0 · source: vendor
OP
open · sindresorhus
7.2.0 before 11.0.0 · source: vendor
OP
opencode · anomalyco
1.0.137 before 1.18.33 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119025
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119025
github.com
https://github.com/anomalyco/opencode/commit/29f07e0c69ad8668e0e15b0eb54f2fcb342af98c
github.com
https://github.com/anomalyco/opencode/pull/51414
github.com
https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-q978-78c7-phqw
github.com
https://github.com/sindresorhus/open/blob/v10.2.0/index.js#L189-L203
github.com
https://github.com/sindresorhus/open/blob/v7.2.0/index.js#L60-L99
github.com
https://github.com/sindresorhus/open/commit/274d70446bf38a7b7d50b214dd3962ef8ea9320d
More from opencode
8.8
CVE-2026-22812
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
6.1
CVE-2026-22813
Malicious website can execute commands on the local system through XSS in the OpenCode web UI