CVE-2026-119025: open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows
CVE-2026-119025 is a vulnerability in open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows, rated Important by Microsoft, with a CVSS 3.1 base score of 7.5 (High). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 1.45% probability of exploitation activity in the next 30 days, higher than 73% of all scored vulnerabilities. Microsoft released the fix on 31 October 2026, outside Patch Tuesday. It affects 1 product in 1 product family (Open Source Software).
Key facts
- CVE ID
- CVE-2026-119025
- Severity
- High CVSS 7.5
- Microsoft severity
- Important
- Exploited in the wild
- No
- Publicly disclosed
- No
- Weakness
- CWE-78
- EPSS
- 1.45% (percentile 73%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- October 2026 Patch Tuesday
- Product families
- Open Source Software
CVSS score and vector
Microsoft scores CVE-2026-119025 at 7.5 (temporal 7.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
Affected products (1)
Open Source Software
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0 | Release Notes | Security Update |
Exploitation and detection
Detection and weaponization
Weaponization maturity: Exploit.
Proof-of-concept repositories (1)
NIST NVD data
- NVD status
- Awaiting Analysis
- NVD CVSS
- 7.5 (HIGH)
- NVD weakness
- CWE-78
- Published to NVD
- NVD last modified
References
- https://github.com/anomalyco/opencode/commit/29f07e0c69ad8668e0e15b0eb54f2fcb342af98c
- https://github.com/anomalyco/opencode/pull/51414
- https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-q978-78c7-phqw
- https://github.com/sindresorhus/open/blob/v10.2.0/index.js#L189-L203
- https://github.com/sindresorhus/open/blob/v7.2.0/index.js#L60-L99
- https://github.com/sindresorhus/open/commit/274d70446bf38a7b7d50b214dd3962ef8ea9320d
- https://github.com/sindresorhus/open/releases/tag/v11.0.0
- https://www.vulncheck.com/advisories/open-7.2.0-before-11.0.0-os-command-injection-via-powershell-on-windows
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |