CVE-2026-119025

PowerShell URL injection reaches MCP Inspector and OpenCode

sindresorhus / Model Context Protocol / Anomaly · open URL launcher in MCP Inspector and OpenCode on Windows/WSL

First documented disclosure · Review checkpoint

Summary

An untrusted OAuth authorization URL can execute PowerShell code when a vulnerable AI tool opens it.

Severity and exploitation evidence

High · 7.7/10 · CVSS 4.0. Severity source.

Exploitation not established: The Inspector researcher demonstrated URL survival and execution of the exact sink string in PowerShell on macOS. Windows/WSL reachability is supported by code review, not a claimed complete Windows end-to-end run. No malicious exploitation is established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The open package interpolates the URL into a PowerShell double-quoted string, allowing subexpression evaluation. A malicious MCP server can supply that URL through OAuth discovery.

Conditions required

Windows or WSL, a vulnerable opener, and an affected client connecting to an attacker-influenced MCP server. Inspector's interactive automatic browser opening must be enabled; this path does not require a model tool call.

Potential impact

Code execution as the invoking user; no privilege escalation or sandbox escape is established.

Affected versions and configurations

open >=7.2.0 and <11.0.0; MCP Inspector >=2.0.0 and <2.12.0; OpenCode >=1.0.137 and <1.18.33, per CNA.

Fix and mitigation status

open 11.0.0; Inspector 2.12.0; OpenCode 1.18.33 for this issue. An open 10.x caret dependency does not automatically pick up 11.x.

Practical next steps

Upgrade affected clients and transitive open dependencies, validate browser-launch URLs, and disable automatic opening of untrusted OAuth URLs pending patching.

Operating lesson

OAuth metadata is remote input, even before an agent invokes a tool.

Evidence and limits

The upstream escaping fix was publicly released November 15, 2025; OpenCode's boundary hardening was public September 25, 2026 and the Inspector advisory October 21. CNA registration is October 29 and its datePublic says October 19; those dates do not erase the earlier public fix. Related 2020/2023 issues describe functional escaping failures rather than this security disclosure. The AI scope rests on the explicit MCP client paths, not the general-purpose package alone. Displayed 7.7 is VulnCheck CVSS 4.0; Inspector's own CVSS 3.1 is 8.8.

Sources