CVE-2026-119025

A flaw was found in the open package. This vulnerability allows an attacker to achieve arbitrary code execution on systems running Windows or Windows Subsystem for Linux (WSL). The issue occurs because the package fails to properly sanitize input URLs before passing them to PowerShell. By providing a crafted URL containing embedded command expressions, an attacker can execute unauthorized commands with the privileges of the running application.

This vulnerability is rated Important due to the potential for arbitrary command execution with the privileges of the running application upon opening crafted URLs. The impact primarily concerns client-side or developer tooling deployed on Windows or Windows Subsystem for Linux (WSL), where the open package delegates URL execution to PowerShell. Standard Red Hat Enterprise Linux environments and containerized Linux services use native opening utilities instead of PowerShell, rendering typical server installations unaffected by this execution vector.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.