https://feed.craftedsignal.io/vendors/opencode/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 15:36:59 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-open-rce/Thu, 29 Oct 2026 15:36:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-open-rce/The 'open' package (versions 7.2.0 before 11.0.0) contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL.<p>The 'open' package, versions 7.2.0 before 11.0.0, is vulnerable to OS command injection. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand. This affects Windows and WSL environments.</p> highadvisory