Description
Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code locally.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | PowerShell 7.4 | 7.4.0 – < 7.4.19.0 | 7.4.19.0 |
| Microsoft | PowerShell 7.5 | 7.5.0 – < 7.5.10.0 | 7.5.10.0 |
| Microsoft | PowerShell 7.6 | 7.6.0 – < 7.6.5 | 7.6.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | powershell | 7.6.9-r0 | — |
Advisories 2
- WID-SEC-2026-2857 Microsoft PowerShell: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Aug 16, 2026
- MSRC-CVE-2026-50523 Microsoft PowerShell Remote Code Execution Vulnerability Microsoft Security Response Center · Aug 14, 2026
References
- Microsoft PowerShell Remote Code Execution Vulnerability vendor-advisory patch