CVE-2026-119025
High
Description
open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Microsoft Azl3 Python-tensorboard
PublishedOct 29, 2026
First seenNov 4, 2026
Weakness typeCWE-78OS command injection
How to fix
Patches
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| microsoft azl3_python-tensorboard_2.16.2-6 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.