Bug 2563323 (CVE-2026-119025)

Summary: CVE-2026-119025 open: open: Arbitrary code execution via crafted URLs
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aazores, abarbaro, abrianik, akostadi, alizardo, amasferr, anpicker, bbrownin, brasmith, cdrage, cmah, cochase, csuconic, dbruscin, dhanak, dmayorov, doconnor, dranck, drosa, dschmidt, dsimansk, eaguilar, ebaron, fmariani, ggrzybek, gmalinko, gtully, hasun, janstey, jchui, jfula, jhe, jlanda, jlledo, jmatsuok, jowilson, jraez, jsherman, jtolenti, jwon, kaycoth, kingland, kshier, ktsao, kvanderr, lchilton, mcarlett, mnovotny, nboldt, nyancey, oaljalju, ometelka, pantinor, parichar, pjindal, psrna, ptisnovs, rbobbitt, rgemmell, rgodfrey, rhel-process-autobot, rstepani, rushinde, sausingh, sdawley, sfeifer, simaishi, stcannon, syedriko, tasato, tbish, tcunning, tlavocat, tsedmik, watson-tool-maintainers, xdharmai, yfang, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the open package. This vulnerability allows an attacker to achieve arbitrary code execution on systems running Windows or Windows Subsystem for Linux (WSL). The issue occurs because the package fails to properly sanitize input URLs before passing them to PowerShell. By providing a crafted URL containing embedded command expressions, an attacker can execute unauthorized commands with the privileges of the running application.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 11:32:34 UTC 
open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.