Description

Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:19:11.520Z",
  "pubdate": "2026-08-11T17:19:11.520Z",
  "executiveSummary": "A vulnerability classified as improper control of generation of code, commonly known as code injection, affects Microsoft PowerShell. This security flaw enables an unauthorized local attacker to successfully bypass a security feature. The primary impact of this vulnerability involves the circumvention of established security controls on the target system, potentially allowing the execution of arbitrary or restricted commands that the security feature was specifically designed to prevent.\nThe affected product is Microsoft PowerShell. The risk implications are significant because a successful compromise undermines the foundational integrity of host-based security boundaries enforced by the scripting environment. Attacker capabilities are restricted by the requirement of local access to the vulnerable system, meaning the threat actor must already possess a foothold or physical/interactive access to execute the payload locally.\nExploitation requirements include local execution context to interact with the Microsoft PowerShell interface or API. While the vulnerability facilitates security feature bypass, the broader implications depend on how PowerShell is integrated into the host operating system's defense-in-depth posture. Organizations relying on PowerShell security configurations, such as constrained language mode or script block logging, may find these mechanisms rendered ineffective during an attack scenario.",
  "technicalDetails": "The root cause of the vulnerability stems from improper control of code generation within Microsoft PowerShell. When PowerShell dynamically constructs, parses, or evaluates code strings, insufficient sanitization or validation allows crafted inputs to inject unintended syntax or command structures. This improper handling breaks the expected execution boundaries of the parsing engine.\nThe vulnerable component resides within the PowerShell code generation and evaluation subsystem. Because the flaw involves improper code generation, specially crafted command arguments or input data supplied to PowerShell can manipulate the internal Abstract Syntax Tree (AST) or evaluation pipeline during runtime. This manipulation allows the injected code to execute under the privileges of the invoking user or process while evading the checks imposed by the targeted security feature.\nThe attack flow proceeds as follows: First, the local attacker identifies an entry point where input is processed and subsequently subjected to improper code generation by Microsoft PowerShell. Second, the attacker crafts a specialized payload designed to exploit the parsing or generation logic flaw. Third, the attacker supplies this payload locally via command-line arguments, scripts, or programmatic invocation APIs. Fourth, the PowerShell engine processes the input, inadvertently incorporating the injected code into the execution flow. Finally, the injected instructions execute, successfully bypassing the intended security feature and achieving the attacker's objective.\nRegarding environmental constraints, the vulnerability requires local access and execution capabilities. Network exposure is not a direct vector unless combined with a separate remote code execution vulnerability that grants local command execution rights. Authentication requirements depend on the local operating system access controls, typically requiring standard user privileges unless the targeted security feature or execution context demands higher privileges. The post-exploitation impact centers on the circumvention of security boundaries, empowering the attacker to execute unauthorized administrative actions, evade detection mechanisms, or facilitate lateral movement and persistence within the local environment."
}