CVE-2026-119025

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $... subexpressions in URLs, such as OAuth authorizationendpoint values from malicious MCP servers, which...