VulnSocial

CVE-2026-119025

LOWCVSS 7.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-30: 110-30
Full discourse1 post
  • YorkDev@YoDevp

    Si tu herramienta de Node abre URLs en el navegador, revisa esto: el paquete npm open (~219M descargas por semana) permite ejecutar PowerShell en Windows y WSL con una URL armada. CVE-2026-119025, severidad alta (CVSS 7.5). #npm https://t.co/0W6MK4chOi

    1000030
    16 followersView on X

Explore more

Back to dashboard