Vendor
The 'open' package (versions 7.2.0 before 11.0.0) contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL.