CVE-2026-119025: Windows/WSL PowerShell URL launcher (index.js -EncodedCommand)
On Windows and WSL, the npm package open placed the target URL unescaped inside a PowerShell double-quoted string and executed it with -EncodedCommand. Because PowerShell evaluates $(...) subexpressions and URL serialization preserves those characters, a remote MCP server can return an OAuth authorization_endpoint containing a payload that runs as soon as MCP Inspector or OpenCode connects, with no tool call or approval.
Executive Summary & Technical Impact
On Windows and WSL, the npm package open placed the target URL unescaped inside a PowerShell double-quoted string and executed it with -EncodedCommand. Because PowerShell evaluates $(...) subexpressions and URL serialization preserves those characters, a remote MCP server can return an OAuth authorization_endpoint containing a payload that runs as soon as MCP Inspector or OpenCode connects, with no tool call or approval.
Tracked under CVE-2026-119025 (CWE-78 (OS Command Injection)), this vulnerability affects open 7.2.0 to before 11.0.0; MCP Inspector 2.0.0–2.11.0; OpenCode 1.0.137–1.18.32 and carries a severity score of 7.7 (CVSS 4.0, VulnCheck) (HIGH). Engineering and security operations teams running npm open; MCP Inspector; OpenCode should prioritize upgrading to open 11.0.0; MCP Inspector 2.12.0; OpenCode 1.18.33.
Remediation & Patch Guidance
- Upgrade open to 11.0.0 or later in projects and global tools (check with npm ls open).
- Upgrade MCP Inspector to 2.12.0 and OpenCode to 1.18.33 or later.
- Only connect MCP clients to trusted remote servers and remove stale server entries whose domains you no longer control.
Frequently Asked Questions (CVE-2026-119025)
What versions are affected by CVE-2026-119025?
CVE-2026-119025 affects open 7.2.0 to before 11.0.0; MCP Inspector 2.0.0–2.11.0; OpenCode 1.0.137–1.18.32 in npm open; MCP Inspector; OpenCode (Windows/WSL PowerShell URL launcher (index.js -EncodedCommand)).
How do I patch or remediate CVE-2026-119025?
Upgrade affected deployments to open 11.0.0; MCP Inspector 2.12.0; OpenCode 1.18.33 and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-119025?
CVE-2026-119025 is rated HIGH with a CVSS score of 7.7 (CVSS 4.0, VulnCheck) (vector: Network; a malicious or hijacked remote MCP server supplies a crafted OAuth authorization URL that runs when the client connects (Windows and WSL only)).
Your AI Dev Tools Are the New Attack Surface: npm 'open' PowerShell Injection (CVE-2026-119025), Langflow RCE, and Broken Built-In Browsers
A malicious MCP server can run code on Windows the moment you connect, Langflow OSS ships 9.8-rated unauthenticated RCE fixes, and new EMBRACE research shows coding-assistant browsers reading local files.
Read full engineering post-mortem (6 min read) →