CVE-2026-119025 | sindresorhus open up to 10.x index.js authorization_endpoint os command injection

October 29, 2026 Yanac

A vulnerability described as critical has been identified in sindresorhus open up to 10.x. This affects an unknown function of the file index.js. The manipulation of the argument authorization_endpoint results in os command injection.

This vulnerability is known as CVE-2026-119025. It is possible to launch the attack remotely. No exploit is available.

A patch should be applied to remediate this issue.VulDB Recent EntriesRead More