OS Command Injection Vulnerability in Open Product by Sindre Sorhus
CVE-2026-119025

7.7HIGH

Key Information:

Vendor

Sindresorhus

Status
Open
Inspector
Opencode
Vendor
CVE Published:
29 October 2026

What is CVE-2026-119025?

The Open product versions 7.2.0 through 10.2.0 contain a vulnerability that permits OS command injection. This flaw allows adversaries to execute malicious PowerShell commands by embedding crafted subexpressions within URLs that are processed by index.js. Attackers can target vulnerable installations on Windows and WSL systems, leading to unauthorized command execution. The vulnerability stems from unescaped inputs being passed to the PowerShell command, primarily through OAuth authorization endpoints sourced from potentially harmful servers.

Affected Version(s)

inspector 2.0.0 < 2.12.0

open 7.2.0 < 11.0.0

opencode 1.0.137 < 1.18.33

References

https://github.com/sindresorhus/open/commit/274d70446bf38...
patch
https://github.com/sindresorhus/open/releases/tag/v11.0.0
release-notes
https://github.com/sindresorhus/open/blob/v10.2.0/index.j...
technical-description

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eilon Cohen (Pillar Security)
.