OS command injection in open via PowerShell on Windows
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 22 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-78.
Summary
open from 7.2.0 before 11.0.0 contains an OS command injection flaw (CWE-78) in which crafted URLs are passed unescaped to PowerShell on Windows and WSL. An attacker who supplies a crafted URL, such as an OAuth endpoint from a malicious MCP server, can run PowerShell code when the affected package processes it. User interaction is required.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sindresorhus | open | 7.2.0 to before 11.0.0 | 11.0.0 | Patch available | CNA |
| MLflow | inspector | 2.0.0 to before 2.12.0 | 2.12.0 | Patch available | CNA |
| anomalyco | opencode | 1.0.137 to before 1.18.33 | 1.18.33 | Patch available | CNA |
- open Vendorsindresorhus Affected 7.2.0 to before 11.0.0 Fixed in 11.0.0 Patch available CNA
- inspector VendorMLflow Affected 2.0.0 to before 2.12.0 Fixed in 2.12.0 Patch available CNA
- opencode Vendoranomalyco Affected 1.0.137 to before 1.18.33 Fixed in 1.18.33 Patch available CNA
Remediation
Upgrade open to 11.0.0, modelcontextprotocol inspector to 2.12.0 and opencode to 1.18.33. Red Hat rates this Important and lists Cryostat 4, Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Pipelines, OpenShift Serverless and other products as affected, with no fix plan available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA open (sindresorhus) Fixed in 11.0.0
- Fix · CNA inspector (modelcontextprotocol) Fixed in 2.12.0
- Fix · CNA opencode (anomalyco) Fixed in 1.18.33
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet |
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Connectivity Link 1 | Affected | No fix yet |
| Red Hat Developer Hub 1 | Affected | No fix yet |
| Red Hat Discovery 2 | Affected | No fix yet |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Secrets Management Console for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Self-service automation portal 2 | Affected | No fix yet |
Not affected: 11 products
- OpenShift Service Mesh 3
- Red Hat 3scale API Management Platform 2
- Red Hat AMQ Broker 7
- Red Hat Ansible Automation Platform 2
- Red Hat Data Grid 8
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat OpenShift AI (RHOAI)
- Red Hat build of Apache Camel for Spring Boot 4
Timeline
- 2026-10-29 Threatist record created from CVE-2026-119025
- 2026-10-29 Alias added: GHSA-jgwm-4pmq-r4w4
- 2026-10-31 Priority changed: MEDIUM → LOW
- 2026-11-03 Affected versions changed · Red Hat
- 2026-11-03 CVSS score added · Red Hat
- 2026-11-03 CISA SSVC decision points changed
- 2026-11-05 Affected versions changed · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
References
More sindresorhus vulnerabilities
- TI-2026-25139 file-type affected by ZIP Decompression Bomb DoS via [Content_Types].xml entry CVSS 3.1MEDIUM 5.3
- TI-2021-02726 Inefficient Regular Expression Complexity in sindresorhus/semver-regex CVSS 3.1HIGH 7.5
- TI-2026-24363 file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header CVSS 3.1MEDIUM 5.3
- TI-2022-16660 An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for… CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-119025 · CVE Program
- CVE-2026-119025 · NVD
- FIRST EPSS
- GHSA-jgwm-4pmq-r4w4 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-119025 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences