CVE-2026-119025 open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows

High 7.7 Published 29 Oct 2026 Updated 29 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-119025?

CVE-2026-119025 is a high-severity vulnerability in anomalyco inspector, published on 29 Oct 2026.

Official description

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.

Weakness: CWE-78

Which versions are affected by CVE-2026-119025?

How do I fix CVE-2026-119025?

No fix has been published for CVE-2026-119025 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119025 being exploited?

There is no known exploitation of CVE-2026-119025 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-jgwm-4pmq-r4w4, GHSA-q978-78c7-phqw.