GHSA-28xh-wpgr-7fm8
Command Injection in open
Versions of open before 6.0.0 are vulnerable to command injection when unsanitized user input is passed in.
The package does come with the following warning in the readme:
The same care should be taken when calling open as if you were calling child_process.exec directly. If it is an executable it will run in a new shell.
Recommendation
open is now the deprecated opn package. Upgrading to the latest version is likely have unwanted effects since it now has a very different API but will prevent this vulnerability.
What each source reports
GitHub AdvisoriesNo score
Command Injection in open
Versions of open before 6.0.0 are vulnerable to command injection when unsanitized user input is passed in.
The package does come with the following warning in the readme:
The same care should be taken when calling open as if you were calling child_process.exec directly. If it is an executable it will run in a new shell.
Recommendation
open is now the deprecated opn package. Upgrading to the latest version is likely have unwanted effects since it now has a very different API but will prevent this vulnerability.
- Record
GHSA-28xh-wpgr-7fm8- Weakness
- CWE-77
- Updated
- 2026-11-02
OSVNo score
Command Injection in open
Versions of open before 6.0.0 are vulnerable to command injection when unsanitized user input is passed in.
The package does come with the following warning in the readme:
The same care should be taken when calling open as if you were calling child_process.exec directly. If it is an executable it will run in a new shell.
Recommendation
open is now the deprecated opn package. Upgrading to the latest version is likely have unwanted effects since it now has a very different API but will prevent this vulnerability.
- Record
GHSA-28xh-wpgr-7fm8- Weakness
- CWE-77
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opennpm | before 6.0.0 | 6.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-28xh-wpgr-7fm8 is a vulnerability with no CVSS score yet in open, published June 20, 2019. No source lists public exploit code. Fixed in open 6.0.0.