Open 7.2.0 to 11.0.0 OS Command Injection via PowerShell

Executive Summary

This vulnerability is an OS command injection flaw in open library versions before 11.0.0. Attackers can execute PowerShell code by injecting crafted URLs containing $(...) subexpressions, such as malicious OAuth authorization_endpoint values. The index.js file passes these unescaped inputs directly to powershell -EncodedCommand, allowing arbitrary command execution on Windows and WSL.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses vulnerable versions of open (>=7.2.0, <11.0.0), inspector (>=2.0.0, <2.12.0), or opencode (>=1.0.137, <1.18.33). Inspect network traffic for suspicious OAuth authorization_endpoint URLs containing $(...) subexpressions. Review logs for unexpected PowerShell command executions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could run malicious PowerShell commands on your system without your interaction. This could allow them to create files, execute programs, or take control of your machine. The attack happens automatically when you connect to a malicious MCP server that provides a crafted URL.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to open v11.0.0 or later. For inspector, upgrade to v2.12.0 or later. For opencode, upgrade to v1.18.33 or later. Validate all URLs before passing them to the opener to ensure they use only http or https protocols.

Useful 0 Not Useful 0