Description

Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-14T14:16:50.473Z",
  "pubdate": "2026-08-14T14:16:50.473Z",
  "executiveSummary": "An improper control of generation of code vulnerability, classified as Code Injection, has been identified in the settings feature of Devolutions PowerShell Universal version 2026.2.3 and earlier. This security flaw allows an authenticated adversary possessing specific settings management permissions to execute arbitrary PowerShell code within the context of the affected application.\nThe root of the vulnerability lies in the improper sanitization and lack of escaping mechanisms applied to user-supplied input when it is serialized and written directly into the settings configuration file. When the application subsequently parses or executes instructions derived from this configuration file, the injected malicious payload is evaluated and executed.\nThe risk implications are severe, as successful exploitation enables full arbitrary code execution, potentially leading to complete system compromise, unauthorized data access, privilege escalation, and lateral movement across the underlying infrastructure.\nExploitation of this vulnerability requires the attacker to be authenticated and possess specific authorization—namely, settings management permissions. Consequently, the primary attack vector relies on abusing legitimate administrative or configuration management interfaces to inject crafted strings into persistent configuration storage.",
  "technicalDetails": "The vulnerability exists within the settings feature of Devolutions PowerShell Universal 2026.2.3 and earlier, specifically within the subsystem responsible for writing application configurations to the settings configuration file.\nThe root cause of the vulnerability is improper control of generation of code (Code Injection). The application fails to adequately sanitize, validate, or escape input values provided through the settings interface before persisting them to disk. When user-supplied data containing specially crafted input or PowerShell syntax is submitted, the application writes the raw, unescaped string directly into the configuration file.\nTo exploit this vulnerability, an attacker must first obtain authentication credentials and possess the necessary authorization, specifically settings management permissions within the Devolutions PowerShell Universal environment. The attacker navigates to the vulnerable settings feature and supplies a crafted setting value containing malicious PowerShell commands.\nUpon submission, the application accepts the input and writes it directly to the settings configuration file without performing requisite sanitization or contextual escaping. During subsequent operations where the configuration file is read, parsed, or executed by the application backend, the injected PowerShell payload is interpreted as executable code rather than static configuration data.\nThe payload behavior results in the execution of arbitrary PowerShell commands under the security context of the Devolutions PowerShell Universal service process. Depending on the privileges assigned to the running service, this can lead to full system compromise, persistent backdoor installation, access to sensitive environment variables, and further post-exploitation activities within the network infrastructure.\nThe affected component is the settings management and configuration writing mechanism present in Devolutions PowerShell Universal versions 2026.2.3 and earlier. Network exposure depends on the deployment architecture of the web-based management interface, and the attack requires valid session access combined with configuration-level privileges."
}