# CVE-2026-119025: open OS command injection in browser URL handling

Source: https://junglewise.ai/threats/cve-2026-119025-open-7-2-0-before-11-0-0-contains-an-os-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-119025 · Severity: high · CVSS 7.5 · Published 2026-10-29

Open is a utility that launches URLs in web browsers on Windows, macOS, and Linux. Versions 7.2.0 through 10.x allow remote attackers to execute arbitrary PowerShell commands on Windows and WSL systems by embedding command substitution syntax in specially crafted URLs, such as those from malicious OAuth providers. An attacker controlling an MCP server can inject code that executes with the privileges of the application using open.

Vendors: [Sindresorhus](https://junglewise.ai/threats/vendors/sindresorhus).

## Quick answers

**Is CVE-2026-119025 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119025 being exploited in the wild.

**How severe is CVE-2026-119025?** High severity, with a CVSS score of 7.5, published 29 October 2026.

**Which products and versions are affected?** Sindresorhus Open 7.2.0 before 11.0.0.

**Is there a fix for CVE-2026-119025?** Yes: fixed in open 11.0.4. Until then: Validate that URLs passed to open use only http:// or https:// schemes before invoking the function. Reject file://, javascript://, custom schemes, and UNC paths at the application boundary before they reach the library. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119025 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119025?** Check whether you run Sindresorhus Open at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in open 11.0.4

Validate that URLs passed to open use only http:// or https:// schemes before invoking the function. Reject file://, javascript://, custom schemes, and UNC paths at the application boundary before they reach the library.

## Technical details

The vulnerability is an OS command injection in open's index.js where unsanitized URLs are passed to PowerShell via the -EncodedCommand parameter on Windows and WSL. Attackers can embed PowerShell subexpressions using $(...) syntax in URLs, such as OAuth authorization_endpoint values from malicious MCP servers. The URL is not validated before being passed to the shell, allowing arbitrary command execution. The fix validates that URLs use only http:// or https:// schemes before passing them to the browser launcher.

## Affected products

- sindresorhus open 7.2.0 before 11.0.0

## Timeline

- 2026-10-29: disclosed

## References

- [https://github.com/anomalyco/opencode/commit/29f07e0c69ad8668e0e15b0eb54f2fcb342af98c](https://github.com/anomalyco/opencode/commit/29f07e0c69ad8668e0e15b0eb54f2fcb342af98c)
- [https://github.com/anomalyco/opencode/pull/51414](https://github.com/anomalyco/opencode/pull/51414)