it is possible to run os commands when opening urls, eg:

open('https://$(calc.exe)')

opens the default browser, but als runs calc.exe

expected

the url argument should be sufficiently escaped when invoking powershell so that this vulnerability cannot be exploited.