Summary
An OS command injection vulnerability in open allows crafted URLs to inject PowerShell subexpressions when URL values are passed to PowerShell without adequate escaping. On Windows and WSL, an attacker may achieve code execution when the application processes attacker-controlled URLs, including authorization endpoints supplied by a malicious MCP server.
An OS command injection vulnerability in open allows crafted URLs to inject PowerShell subexpressions when URL values are passed to PowerShell without adequate escaping. On Windows and WSL, an attacker may achieve code execution when the application processes attacker-controlled URLs, including authorization endpoints supplied by a malicious MCP server.
Affected context
The vulnerability affects deployments of open on Windows or WSL where URL values can be influenced by an attacker and are later incorporated into a PowerShell command. Risk is higher when the application consumes authorization endpoint values or other URL fields from untrusted MCP servers without enforcing a trusted source or validating the complete URL structure.
The vulnerability affects deployments of open on Windows or WSL where URL values can be influenced by an attacker and are later incorporated into a PowerShell command. Risk is higher when the application consumes authorization endpoint values or other URL fields from untrusted MCP servers without enforcing a trusted source or validating the complete URL structure.
Exploit preconditions
- Attack surface: URL-processing logic that invokes PowerShell on Windows or WSL
- Required access: Ability to provide or influence a URL consumed by the application, potentially through a malicious MCP server
- Trigger point: Processing of the crafted URL by
index.jsand its subsequent use withpowershell -EncodedCommand - Why exploitation is possible: URL content is passed into a command context without sufficient escaping or separation from PowerShell expression syntax
- Attack surface: URL-processing logic that invokes PowerShell on Windows or WSL
- Required access: Ability to provide or influence a URL consumed by the application, potentially through a malicious MCP server
- Trigger point: Processing of the crafted URL by
index.jsand its subsequent use withpowershell -EncodedCommand - Why exploitation is possible: URL content is passed into a command context without sufficient escaping or separation from PowerShell expression syntax
Why this happens
The underlying flaw is the construction of a PowerShell command from attacker-influenced URL data without treating that data as strictly inert input. PowerShell subexpressions such as $() can be interpreted as executable expressions when they reach the command parser. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
The underlying flaw is the construction of a PowerShell command from attacker-influenced URL data without treating that data as strictly inert input. PowerShell subexpressions such as $() can be interpreted as executable expressions when they reach the command parser. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
Potential impact
- An attacker may execute arbitrary PowerShell commands in the application process context.
- The vulnerability could expose local files, credentials, tokens, or environment variables.
- A compromised process may alter application data or configuration.
- Attackers could use the affected host as a foothold for broader Windows or WSL compromise.
- The impact may be limited or expanded by the privileges granted to the application.
- An attacker may execute arbitrary PowerShell commands in the application process context.
- The vulnerability could expose local files, credentials, tokens, or environment variables.
- A compromised process may alter application data or configuration.
- Attackers could use the affected host as a foothold for broader Windows or WSL compromise.
- The impact may be limited or expanded by the privileges granted to the application.
General mitigation guidance
Mitigation generally focuses on preventing attacker-controlled URL data from becoming executable command syntax.
Common defensive patterns include:
- Avoiding shell invocation when a native library or direct process API can perform the required operation.
- Passing untrusted values as separated, typed arguments rather than concatenating them into command strings.
- Applying strict URL parsing and allowlisting for schemes, hosts, paths, and permitted authorization endpoints.
- Treating MCP-provided metadata as untrusted and requiring explicit trust validation before use.
- Applying context-appropriate escaping and command construction controls when PowerShell is unavoidable.
- Running the application with least privilege and restricting access to sensitive files, credentials, and administrative operations.
Mitigation generally focuses on preventing attacker-controlled URL data from becoming executable command syntax.
Common defensive patterns include:
- Avoiding shell invocation when a native library or direct process API can perform the required operation.
- Passing untrusted values as separated, typed arguments rather than concatenating them into command strings.
- Applying strict URL parsing and allowlisting for schemes, hosts, paths, and permitted authorization endpoints.
- Treating MCP-provided metadata as untrusted and requiring explicit trust validation before use.
- Applying context-appropriate escaping and command construction controls when PowerShell is unavoidable.
- Running the application with least privilege and restricting access to sensitive files, credentials, and administrative operations.
How teams detect issues like this
Organizations can look for:
- Static analysis findings involving shell or PowerShell command construction from URL, network, or configuration values.
- Code review signals such as string concatenation, interpolation, or encoding performed before
powershell -EncodedCommandinvocation. - Tests that exercise metacharacters and expression syntax in every externally controlled URL field.
- Runtime monitoring for unexpected PowerShell child processes, encoded command activity, or unusual parent-child process relationships.
- Policy enforcement that requires approved URL hosts and prohibits untrusted MCP metadata from selecting authorization endpoints.
Automated code review and SAST tools may help identify command sinks and incomplete input-trust boundaries.
Organizations can look for:
- Static analysis findings involving shell or PowerShell command construction from URL, network, or configuration values.
- Code review signals such as string concatenation, interpolation, or encoding performed before
powershell -EncodedCommandinvocation. - Tests that exercise metacharacters and expression syntax in every externally controlled URL field.
- Runtime monitoring for unexpected PowerShell child processes, encoded command activity, or unusual parent-child process relationships.
- Policy enforcement that requires approved URL hosts and prohibits untrusted MCP metadata from selecting authorization endpoints.
Automated code review and SAST tools may help identify command sinks and incomplete input-trust boundaries.
