open npm package: OS command injection via PowerShell on Windows
Summary
The npm package open (versions 7.2.0 to before 11.0.0) can execute PowerShell code on Windows and WSL when crafted URLs are passed to it. Attackers can embed $(...) subexpressions in URLs, for example OAuth authorization_endpoint values from malicious MCP servers, which run when the package passes them unescaped to PowerShell. Exploitation requires a user to open or process such a URL, for example by connecting to a malicious MCP server.
Affected
- open (sindresorhus): 7.2.0 to before 11.0.0
- MCP Inspector (modelcontextprotocol inspector): 2.0.0 to before 2.12.0
- opencode (anomalyco opencode): 1.0.137 to before 1.18.33
Fixed in
- open: 11.0.0
- MCP Inspector: 2.12.0
- opencode: 1.18.33
Workaround
Unknown.
Exploitation
- No public proof of concept or confirmed exploitation known at the time of writing.
- NVD analysis is still pending.
Our recommendation
- Identify transitive copies of open in the 7.2.0 to 10.x range in your lockfiles and upgrade to 11.0.0 or later.
- Update MCP Inspector to 2.12.0 or later and opencode to 1.18.33 or later.
- Until patched, avoid connecting developer tools to untrusted MCP servers and avoid opening unfamiliar URLs through them on Windows or WSL.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
shouvikkkk/oauth-sink-check
Research sources
- VulnCheck CNA advisory www.vulncheck.com
- open v11.0.0 release github.com
- open fix commit github.com
- MCP Inspector GHSA-q978-78c7-phqw github.com
- opencode fix commit github.com
- opencode pull request 51414 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 07:42.
Original description (NVD)
open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.
NVD references (8)
- https://github.com/anomalyco/opencode/commit/29f07e0c69ad8668e0e15b0eb54f2fcb342af98c
- https://github.com/anomalyco/opencode/pull/51414
- https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-q978-78c7-phqw
- https://github.com/sindresorhus/open/blob/v10.2.0/index.js#L189-L203
- https://github.com/sindresorhus/open/blob/v7.2.0/index.js#L60-L99
- https://github.com/sindresorhus/open/commit/274d70446bf38a7b7d50b214dd3962ef8ea9320d
- https://github.com/sindresorhus/open/releases/tag/v11.0.0
- https://www.vulncheck.com/advisories/open-7.2.0-before-11.0.0-os-command-injection-via-powershell-on-windows
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.