npm open CVE-2026-119025

Exploitation requires all of: (1) the victim host is Windows, or WSL outside a container (the vulnerable branch is platform==='win32' || (isWsl && !isInsideContainer() && !app)) - macOS and Linux are NOT affected because there open uses spawn with an argv instead of a shell; (2) a consuming application passes an attacker-controlled URL to open - here MCP Inspector (CLI, TUI, or web) or opencode taking the OAuth authorization_endpoint from a remote server's RFC 8414 discovery response; (3) the victim connects to an MCP server the attacker operates or has compromised/typosquatted; (4) auto-open is enabled, which is the default (on unless MCP_AUTO_OPEN_ENABLED=false or Vitest is running) with stderr a TTY, i.e. an interactive developer session. Once those hold there is no further click, approval, tool invocation, or model decision - the chain fires during connection. Limiting factors for defenders: the Windows/WSL-only requirement, the need to connect to a hostile server, and that the open library alone is not exploitable without a consumer feeding it untrusted URLs.

This is a genuine, confirmed remote code execution flaw (CWE-78/CWE-88) in the heavily-used npm open package, reached through consumers like MCP Inspector and opencode. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P, VC/VI/VA:H, score 7.7) tells a coherent story: network-reachable, low complexity, no victim privileges required, but with an attack requirement (AT:P) and passive user interaction (UI:P) that temper it - these correspond to the hard real-world constraints that the victim must be on Windows or WSL (macOS/Linux are explicitly NOT affected, because there open uses spawn with an argv rather than a shell) and must connect to an attacker-operated MCP server. The signals mostly reinforce each other rather than conflict: a detailed, demonstrated PoC is published in the MCP GHSA advisory, and the vuln.today decision label is this_week (not act_now/emergency). The flaw is NOT in CISA KEV (no confirmed active exploitation), and no EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quoted. Net: for organizations running MCP Inspector or opencode on Windows/WSL this is a real, actionable priority warranting patching this week, but it is a targeted data-flow condition (connect to a hostile server on a specific platform) rather than an internet-wide mass-exploitation event, which is consistent with the absence of KEV and the AT:P/UI:P modifiers.

A developer on Windows or WSL uses MCP Inspector (or opencode) to connect to an untrusted remote MCP server. The server answers 401 and serves OAuth discovery documents whose attacker-chosen authorization_endpoint is a URL like https://evil.test/$([IO.File]::WriteAllText('C:\Users\Public\pwned.txt','RCE')); the client auto-opens it, open passes it unescaped into a PowerShell double-quoted string run via powershell -EncodedCommand, and the $(...) subexpression executes arbitrary code as the user with no prompt, click, tool call, or model involvement. A detailed PoC (malicious server, reproduction command, and a demonstrated injection at the sink) is published in the GHSA advisory.