CVE-2026-119025

About vulnerability

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(…) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.

Affected product:

@ledgerhq/lumen-ui-rnative , @vinxi/devtools , AngularJS , Next.js , React , Vue , adk-js , aegir , ai-sdk-harness-pi , ai-sdk-workflow , ai-sdk-workflow-harness , amplify-js , analogjs-platform , analogjs-storybook-angular , analogjs-vite-plugin-angular , analogjs-vite-plugin-nitro , angular-create , angular-devkit-build-angular , angular-devkit-build-webpack , applicationinsights-node.js , assistant-ui-react-native , astro , astrojs-vue , async-storage , augment-vir-test , aws-amplify , aws-amplify-api , aws-amplify-api-rest , aws-amplify-auth , aws-amplify-cache , aws-amplify-core , aws-amplify-geo , aws-amplify-interactions , aws-amplify-predictions , aws-amplify-pubsub , aws-sdk-credential-provider-cognito-identity , aws-sdk-js-v3 , aws-sdk-middleware-retry , aws-sdk-middleware-sdk-transcribe-streaming , azure-sdk-for-js , b4a , babel-plugin-remove-graphql-queries , babel-preset-expo , bare-fs , bare-stream , better-auth-cli , better-opn , blake2b , blake2b-wasm , blockchain-link-utils , botbuilder-js , browsers , bugsnag-plugin-react-native-navigation , bugsnag-plugin-react-navigation , callstack-repack , callstack-repack-plugin-expo-modules , callstack-repack-plugin-nativewind , callstack-repack-plugin-reanimated , capacitor , celo-celocli , celo-wallet-hsm-azure , chialab-rna-browser-test-runner , chialab-rna-saucelabs-test-runner , chromatic-com-storybook , chromatic-e2e , cjk-regex , clerk-chrome-extension , clerk-clerk-expo , clerk-clerk-js , clerk-expo , clerk-expo-biometrics , clerk-expo-google-signin , clerk-expo-native-components , clerk-expo-passkeys , coin-modules , confluent-kafka-javascript , copilotkit-react-native , craftzdog-react-native-buffer , create-nx-plugin , create-nx-workspace , create-react-app , create-sanity , create-storybook , create-strapi , create-strapi-app , datadog-mobile-react-native , datadog-mobile-react-native-apollo-client , datadog-mobile-react-native-babel-plugin , datadog-mobile-react-native-code-push , datadog-mobile-react-native-navigation , datadog-mobile-react-native-openfeature , datadog-mobile-react-native-webview , datadog-mobile-react-navigation , dd-sdk-reactnative , deepeval , definitelytyped , dev-middleware , device-sdk-ts , docsearch , docusaurus , docusaurus-core , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-preset-classic , docusaurus-search-local , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-mermaid , docusaurus-theme-search-algolia , dotenvx-dotenvx , dr.pogodin-react-native-fs , eas-cli , ecosystem , effect-sql-mssql , effect-sql-sqlite-react-native , elevenlabs-react-native , emotion-native , esbuild-visualizer , eslint-plugin-storybook , expect-webdriverio , expo , expo-ads-admob , expo-ads-facebook , expo-analytics-segment , expo-app-integrity , expo-app-intents , expo-app-loading , expo-apple-authentication , expo-application , expo-asset , expo-audio , expo-auth-session , expo-av , expo-background-fetch , expo-background-task , expo-barcode-scanner , expo-battery , expo-blur , expo-branch , expo-brightness , expo-build-properties , expo-calendar , expo-camera , expo-checkbox , expo-cli , expo-clipboard , expo-config , expo-config-plugins , expo-configure-splash-screen , expo-constants , expo-contacts , expo-crypto , expo-dev-client , expo-dev-client-components , expo-dev-launcher , expo-dev-menu , expo-dev-menu-interface , expo-dev-server , expo-dev-tools , expo-device , expo-document-picker , expo-electron-adapter , expo-error-recovery , expo-expo-cli , expo-file-system , expo-firebase-analytics , expo-firebase-core , expo-firebase-recaptcha , expo-font , expo-gl , expo-glass-effect , expo-google-app-auth , expo-google-sign-in , expo-haptics , expo-hinge , expo-html-elements , expo-image , expo-image-loader , expo-image-picker , expo-insights , expo-intent-launcher , expo-keep-awake , expo-linear-gradient , expo-linking , expo-local-authentication , expo-localization , expo-location , expo-mail-composer , expo-manifests , expo-maps , expo-media-library , expo-mesh-gradient , expo-metro-config , expo-module-scripts , expo-module-template , expo-modules-cli , expo-modules-core , expo-modules-jsi , expo-modules-test-core , expo-navigation-bar , expo-network , expo-network-addons , expo-next-adapter , expo-notifications , expo-payments-stripe , expo-permissions , expo-prebuild-config , expo-print , expo-processing , expo-pwa , expo-random , expo-router , expo-router-server , expo-screen-capture , expo-screen-orientation , expo-secure-store , expo-sensors , expo-sharing , expo-sms , expo-speech , expo-splash-screen , expo-sqlite , expo-standard-web-crypto , expo-status-bar , expo-store-review , expo-stories , expo-symbols , expo-system-ui , expo-task-manager , expo-template-bare-minimum , expo-template-blank , expo-template-blank-typescript , expo-template-default , expo-template-tabs , expo-tracking-transparency , expo-updates , expo-updates-interface , expo-vector-icons , expo-video , expo-video-thumbnails , expo-web-browser , expo-webpack-config , expo-widgets , expo-xdl , expo-yarn-workspaces , flagsmith-js-client , forge , fumadocs-sanity , gatsby , gatsby-cli , gatsby-cypress , gatsby-interface , gatsby-plugin-compile-es6-packages , gatsby-plugin-emotion , gatsby-plugin-fathom , gatsby-plugin-feed , gatsby-plugin-google-gtag , gatsby-plugin-guess-js , gatsby-plugin-less , gatsby-plugin-manifest , gatsby-plugin-netlify , gatsby-plugin-no-sourcemaps , gatsby-plugin-offline , gatsby-plugin-page-creator , gatsby-plugin-postcss , gatsby-plugin-preact , gatsby-plugin-preload-fonts , gatsby-plugin-react-helmet , gatsby-plugin-schema-snapshot , gatsby-plugin-sharp , gatsby-plugin-sitemap , gatsby-plugin-styletron , gatsby-plugin-typography , gatsby-react-router-scroll , gatsby-remark-code-repls , gatsby-remark-embed-snippet , gatsby-remark-prismjs , gatsby-remark-responsive-iframe , gatsby-sharp , gatsby-source-contentful , gatsby-source-drupal , gatsby-source-filesystem , gatsby-source-graphql , gatsby-source-shopify , gatsby-source-wordpress , gatsby-transformer-react-docgen , gatsby-transformer-remark , gatsby-transformer-sqip , gatsby-transformer-toml , google-adk , gorhom-bottom-sheet , gorhom-portal , graphql-inspector-cli , graphql-inspector-docs-command , graphql-inspector-serve-command , graphql-mesh-cli , graphql-mesh-migrate-config-cli , gutenberg , hey-api , hey-api-client-axios , hey-api-client-fetch , hiero-sdk-js , ionic-cli , javascript , jest-expo , jest-expo-enzyme , journeyapps-react-native-quick-sqlite , json-render-react-native , language-tools , leafygreen-ui , ledger-cosmos-js , ledger-live , ledgerhq-coin-celo , ledgerhq-crypto-icons , ledgerhq-crypto-icons-ui , ledgerhq-device-transport-kit-react-native-hid , ledgerhq-domain-service , ledgerhq-icons-ui , ledgerhq-live-cli , ledgerhq-live-common , ledgerhq-native-ui , ledgerhq-react-ui , lerna , lg-tools-storybook-addon , lg-tools-storybook-decorators , lg-tools-storybook-utils , libp2p-interface-compliance-tests , libp2p-interfaces-compliance-tests , libp2p-interop , libp2p-webrtc , lighthouse , lingui-metro-transformer , lit-labs-testing , livekit-react-native , livestore , localforage-asyncstorage-driver , lottie-react-native , lucide-react-native , lynx-js-rspeedy , magic-js , magiclabs/magic-js , masked-view , mastra , mastra-blaxel , mastra-deepeval , mdx , mem0-openclaw-mem0 , mem0ai , metamask-core , microsoft-365-agents-toolkit , microsoft-rush , microsoft-rush-lib , mikro-orm-mssql , miniapps , mobile-wallet-adapter , modern.js , module-federation-core , module-federation/core , mongodb-data-service , mongodb-js-connection-form , mongodb-js-connection-info , mongodb-js-devtools-connect , mongodb-js-oidc-plugin , mongodb-js/mongosh , mongosh , mongosh-browser-runtime-electron , mongosh-editor , mongosh-logging , native-html-css-processor , native-html-transient-render-engine , nativewind , nitro , nitroparty , node-archiver , node-mssql , npm:gatsby-theme-blog-core , nuxt , nuxt-devtools , nuxt-devtools-kit , nuxt-devtools-ui-kit , nuxt-nitro-server , nuxt-rspack-builder , nuxt-vite-builder , nuxt-vite-server , nuxt-webpack-builder , nx , nx-angular , nx-angular-rspack , nx-angular-rspack-compiler , nx-cypress , nx-detox , nx-devkit , nx-docker , nx-esbuild , nx-eslint , nx-eslint-plugin , nx-expo , nx-express , nx-jest , nx-js , nx-maven , nx-module-federation , nx-nest , nx-next , nx-node , nx-oxlint , nx-playwright , nx-plugin , nx-react , nx-react-native , nx-rollup , nx-rsbuild , nx-rspack , nx-storybook , nx-vite , nx-vitest , nx-vue , nx-web , nx-webpack , nx-workspace , octanejs-docusaurus , office-addin-debugging , office-addin-dev-settings , onflow-fcl-react-native , onnxruntime-common , op-sqlite , open , open-editor , open-wc , open-wc-building-webpack , open-wc-demoing-storybook , open-wc-semantic-dom-diff , open-wc-testing , open-wc-testing-karma , open-wc-testing-karma-bs , opencode , opencode-plugin , opencode-plugin-browser , opencode-sdk , opencode-simulation , opencode-util , openuidev-cli , orama-orama , parcel-reporter-zephyr , patch-package , patch-project , pi-mcp-adapter , pkgr-utils , playwright-test-scoped , pnpm , pnpm-auth.commands , pnpm-building.after-install , pnpm-deps.inspection.commands , pnpm-engine.pm.commands , pnpm-engine.runtime.commands , pnpm-installing.deps-installer , pnpm-network.web-auth , pnpm-registry-access.commands , pnpm-releasing.commands , pnpm-workspace.commands , posthog-react-native-plugin , posthog-react-native-session-replay , powersync-nuxt , powersync-op-sqlite , powersync-react-native , prettier-plugin-astro , puppeteer-core , recyclerlistview , redis-entraid , redocly-cli , redocly-respect-core , release-it , remotion-babel-loader , remotion-bundler , remotion-cli , remotion-cloudrun , remotion-enable-scss , remotion-lambda , remotion-serverless , remotion-studio , remotion-studio-server , remotion-tailwind , remotion-tailwind-v4 , reown-appkit , reown-appkit-controllers , reown-appkit-scaffold-ui , reown-appkit-ui , reown-appkit-utils , repack , rock-js-plugin-expo-config-plugins , rock-js-plugin-metro , rock-js-plugin-repack , rock-js-template-default , rock-js-welcome-screen , rollup-plugin-visualizer , rollup-plugin-zephyr , rsdoctor , rsdoctor-core , rsdoctor-rspack-plugin , rsdoctor-sdk , rsdoctor-webpack-plugin , rspack-cli , rspack-dev-server , rstest , runtime-cli , rushstack , rushstack-heft-rspack-plugin , rushstack-heft-vscode-extension-plugin , rushstack-heft-vscode-extension-rig , rushstack-heft-web-rig , rushstack-heft-webpack4-plugin , rushstack-heft-webpack5-plugin , rushstack-lockfile-explorer , rushstack-rush-azure-storage-build-cache-plugin , rushstack-rush-cli-client , sanity , sanity-blueprints , sanity-cli , sanity-cli-build , sanity-plugin-mux-input , sanity-preview-url-secret , sanity-vercel-protection-bypass , sanity-vision , sb , sdk-typescript , sentry-gatsby , sentry-nuxt , sentry-solidstart , shadcn , shadcn-registry , sharp , shopify-flash-list , shopify-react-native-skia , sigstore-cli , size-limit-esbuild-why , size-limit-rolldown-why , size-limit-webpack-why , snowplow-javascript-tracker , solana-connector , solana-mobile-mobile-wallet-adapter-protocol , solana-mobile-mobile-wallet-adapter-protocol-kit , solana-mobile-mobile-wallet-adapter-protocol-web3js , solana-wallet-adapter-base-ui , solana-wallet-adapter-example , solana-wallet-adapter-react-ui , solidjs-start , statoscope , storybook , storybook-addon-a11y , storybook-addon-actions , storybook-addon-backgrounds , storybook-addon-controls , storybook-addon-docs , storybook-addon-essentials , storybook-addon-highlight , storybook-addon-interactions , storybook-addon-jest , storybook-addon-links , storybook-addon-mcp , storybook-addon-mdx-gfm , storybook-addon-measure , storybook-addon-onboarding , storybook-addon-outline , storybook-addon-pseudo-states , storybook-addon-storysource , storybook-addon-themes , storybook-addon-toolbars , storybook-addon-viewport , storybook-addon-vitest , storybook-addon-webpack5-compiler-swc , storybook-angular , storybook-angular-vite , storybook-blocks , storybook-builder-manager , storybook-builder-vite , storybook-builder-webpack5 , storybook-channels , storybook-cli , storybook-client-logger , storybook-codemod , storybook-components , storybook-core , storybook-core-common , storybook-core-events , storybook-core-server , storybook-core-webpack , storybook-csf-plugin , storybook-csf-tools , storybook-dark-mode , storybook-docs-tools , storybook-ember , storybook-experimental-addon-test , storybook-experimental-nextjs-vite , storybook-html , storybook-html-vite , storybook-html-webpack5 , storybook-instrumenter , storybook-manager , storybook-manager-api , storybook-nextjs , storybook-nextjs-vite , storybook-node-logger , storybook-preact , storybook-preact-vite , storybook-preact-webpack5 , storybook-preset-create-react-app , storybook-preset-html-webpack , storybook-preset-preact-webpack , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-preset-svelte-webpack , storybook-preset-vue3-webpack , storybook-preview , storybook-preview-api , storybook-react , storybook-react-dom-shim , storybook-react-native-theming , storybook-react-native-web-vite , storybook-react-vite , storybook-react-webpack5 , storybook-router , storybook-server , storybook-server-webpack5 , storybook-source-loader , storybook-svelte , storybook-svelte-vite , storybook-svelte-webpack5 , storybook-sveltekit , storybook-tanstack-react , storybook-telemetry , storybook-test , storybook-theming , storybook-types , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , strapi-cloud-cli , strapi-core , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-strapi , streamx , styled-components , styleguide , synckit , tabler-icons , tanstack-ai-sandbox-blaxel , tanstack-expo-db-sqlite-persistence , tanstack-react-native-db-sqlite-persistence , tanstack-react-query , tar-fs , tar-stream , teams.ts , tedious , teex , temporalio-google-adk-agents , text-decoder , theme-ui , trezor-connect-web , trezor-env-utils , trezor-suite , turso , unimodules-task-manager-interface , unstorage , vercel-cli-auth , victory-native , vinxi , vinxi-router , vinxi-server-components , vinxi-server-functions , virmator , virmator-plugin-testing , virmator-test , vite-plugin-inspect , vite-plugin-storybook-nextjs , vite-plugin-tanstack-start-zephyr , vite-plugin-vinext-zephyr , vite-plugin-zephyr , vscode-vsce , wallet-adapter , wallet-ui-react-native-kit , wallet-ui-react-native-web3js , walletconnect-core , walletconnect-monorepo , walletconnect-sign-client , walletconnect-solana-adapter , walletconnect-types , walletconnect-universal-provider , walletconnect-utils , walletconnect-utils-scoped , wdio-config , wdio-devtools-service , wdio-globals , wdio-lighthouse-service , wdio-local-runner , wdio-runner , wdio-utils , web , web-dev-server , web-dev-server-polyfill , web-storybook-builder , web-storybook-framework-web-components , web-test-runner , web-test-runner-browserstack , web-test-runner-chrome , web-test-runner-commands , web-test-runner-core , web-test-runner-coverage-v8 , web-test-runner-junit-reporter , web-test-runner-mocha , web-test-runner-playwright , web-test-runner-puppeteer , web-test-runner-saucelabs , web-test-runner-selenium , web-test-runner-visual-regression , web-test-runner-webdriver , webdriver , webdriverio , webpack-dev-server , webpack-plugin-serve , wordpress-block-editor , wordpress-components , wordpress-e2e-test-utils-playwright , wordpress-scripts , workflow , workflow-ai , workflow-cli , workflow-world-testing , x402 , xdl , zbsearch-plugin-docusaurus , zephyr-agent , zephyr-astro-integration , zephyr-metro-plugin , zephyr-modernjs-plugin , zephyr-native-cache , zephyr-nuxt-module , zephyr-packages , zephyr-repack-plugin , zephyr-rolldown-plugin , zephyr-rsbuild-plugin , zephyr-rspack-plugin , zephyr-rspress-plugin , zephyr-webpack-plugin , zephyr-xpack-internal

Affected packages:

open @ 8.4.2 (+13012 more)