What happened
CVE-2026-119025 / GHSA-jgwm-4pmq-r4w4: open 7.2.0 through 11.0.0 passes unescaped URLs (including OAuth authorization_endpoint values supplied by a malicious MCP server) to `powershell -EncodedCommand` on Windows and WSL. The $(...) subexpressions embedded in the URL are evaluated as shell, so a malicious remote MCP server's OAuth endpoint yields arbitrary code execution on the developer's machine when the client runs the authorization flow.
Why it matters
This is a concrete agent-execution attack class: an attacker controls an MCP server that the agent connects to, and the OAuth handshake alone is enough to run arbitrary code with the developer's privileges. It converts 'connect to an MCP server' into host RCE in a coding-agency deployment.
Attack vector
A user connects a remote MCP server whose OAuth authorization_endpoint contains $(...) command substitution; the client builds a powershell -EncodedCommand command from the unescaped URL and executes it.
Affected systems
open / opencode 7.2.0 to before 11.0.0.
Mitigation
Upgrade to open 11.0.0 or later; validate/allow-list MCP server authorization endpoints and avoid connecting to unverified remote MCP servers on Windows/WSL hosts.