Threats tagged 'ghsa-jgwm-4pmq-r4w4'

Versions of open from 7.2.0 up to but not including 11.0.0 contain an OS command injection vulnerability. This flaw allows attackers to execute arbitrary PowerShell commands on Windows and Windows Subsystem for Linux (WSL) by crafting malicious URLs that include $(...) subexpressions. The vulnerability arises because index.js passes these URL components unescaped to powershell -EncodedCommand, enabling code execution.