A crafted URL could run PowerShell on Windows through the open package, and MCP Inspector and OpenCode were affected

CVE-2026-119025 was published October 29, 2026 by VulnCheck. It covers open, the npm package that opens URLs and files in the default app, versions 7.2.0 to before 11.0.0. The record says that on Windows and WSL, open passed URLs unescaped to PowerShell, so a URL containing a $(...) subexpression ran PowerShell code. Its example is an OAuth authorization_endpoint value sent by a malicious MCP server. The record lists MCP Inspector 2.0.0 to before 2.12.0 and OpenCode (npm opencode-ai) 1.0.137 to before 1.18.33 as affected, names CWE-78, OS command injection, and scores it CVSS 4.0 7.7 High. NVD carries the same description.

MCP Inspector's own advisory, GHSA-q978-78c7-phqw, published October 21, 2026, describes how it is reached. A remote MCP server answers a connection with 401 and names an OAuth authorization endpoint of its choosing, and Inspector opens that URL automatically while connecting. The advisory says this happens with no prompt, no tool call and no model involvement, and that code runs as the user who started Inspector. The advisory's CLI auto-open setting defaults to enabled outside Vitest and can be disabled with MCP_AUTO_OPEN_ENABLED=false. The TUI OAuth callback calls its opener without checking that setting. The advisory says macOS and Linux are not affected, and it claims nothing beyond code execution as the invoking user. It lists MCP Inspector 2.12.0 as the patched version.

The advisory quotes the open readme, which says the package makes no security guarantees for untrusted input, so the calling app has to check URLs before passing them in. It also says open 11.0.0 escapes the URL before handing it to PowerShell. OpenCode's affected range comes from the CVE record; OpenCode 1.18.33 is the first version outside it.