Your AI Dev Tools Are the New Attack Surface: npm 'open' PowerShell Injection (CVE-2026-119025), Langflow RCE, and Broken Built-In Browsers

The tools developers use to build with AI, such as MCP clients, agent workflow builders, and coding assistants, now pull in URLs, configs, and pages from servers they don’t control. Three disclosures published on October 28–29, 2026 show how directly that can land on a developer’s machine.

CVE-2026-119025: one OAuth URL, code execution on Windows

The npm package open is the standard way Node.js tools open a URL in the user’s browser. From 7.2.0 to before 11.0.0, on Windows and WSL, it built a PowerShell command by placing the URL inside a double-quoted string without escaping it, then ran it with powershell -EncodedCommand.

PowerShell evaluates $(...) subexpressions inside double-quoted strings, and standard URL serialization keeps $, (, and ) intact. So a URL like https://evil.test/$(...) is enough to run arbitrary PowerShell. According to the MCP Inspector advisory, the same function already escaped the application path five lines earlier but not the URL.

Why MCP makes this dangerous. When a remote MCP server answers 401, the client fetches its OAuth discovery document and opens the authorization_endpoint the server chose. Tools that pass that string to open give the server code execution during connection, with no tool call, no model involvement, and no approval prompt. The server doesn’t even need to have been malicious when you added it, since the payload arrives at request time. An expired domain or a later compromise works just as well.

Affected apps named in the CVE record:

VulnCheck assigned the CVE on October 29 and rates it High (CVSS 4.0 7.7). Pillar Security, which found it, had proposed 9.8 for OpenCode. macOS and Linux are not affected, because open spawns open or xdg-open with an argument list there instead of a shell. No in-the-wild exploitation has been reported.

Langflow OSS: unauthenticated RCE and auth bypass

IBM published security bulletins on October 28 for Langflow OSS 1.0.0 through 1.12.8, the open-source visual builder for AI agents and workflows. The CVE records followed on October 29. The headline issues:

• CVE-2026-110186 (CVSS 9.8): unauthenticated code injection that IBM says is exploitable through MCP tool enumeration.
• CVE-2026-93680 (CVSS 9.8): an incomplete fix to the auto-login security control that allows authentication bypass.
• CVE-2026-104339 (CVSS 9.8): unauthenticated OS command injection, from a companion bulletin.
• Several authenticated code execution flaws (CVSS 8.8–9.9), including CVE-2026-110193, where a low-privileged user can get the Agentic Assistant to generate component code that runs OS commands, plus API key exposure, path traversal, and vulnerable bundled dependencies such as Hono.

The fix for all of them is Langflow OSS 1.13.0, released October 22. IBM lists no workarounds. Langflow has a history of being exploited quickly after disclosure, so internet-facing instances should be treated as urgent.

EMBRACE: coding-assistant browsers reach the host

Also on October 29, Forever Security published research it calls EMBRACE on the browsers built into five AI coding assistants. Its findings:

• Cursor: a booby-trapped page got the agent to run a host command with a single Enter (fixed October 1).
• GitHub Copilot: a page could spoof the address bar to show github.com to both the user and the agent (fixed in Copilot 1.1.29).
• Codex, VS Code, and Claude Desktop: a single local HTML file opened in the built-in browser could read and exfiltrate any file on disk, such as SSH keys, .env files, and npm tokens.

At publication, Codex and VS Code had no fix. The researchers say Microsoft declined the report, citing Workspace Trust, and OpenAI didn’t reply. There’s no CVE for these yet.

What to do

1. Run npm ls open in your Node.js projects and global tool installs. Anything below 11.0.0 that opens server-supplied URLs on Windows or WSL needs an update.
2. Upgrade MCP Inspector to 2.12.0 and OpenCode to 1.18.33 or later.
3. Only connect MCP clients to remote servers you trust, and remove stale entries whose domains you no longer control.
4. Upgrade Langflow OSS to 1.13.0 and keep it off the public internet. Back up the database, secret key, and uploads first, then rotate any API keys stored in flows.
5. Don’t open untrusted HTML files in the built-in browsers of Codex or VS Code until fixes ship. Use your normal browser instead.

For more developer infrastructure advisories, see our security tracker.