EUVD-2026-48608
GHSA-r97q-2669-f2rm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (DEVOLUTIONS) · only source for this CVE.
CVSS VectorVendor: DEVOLUTIONS
Lifecycle Timeline
5DescriptionCVE.org
Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file.
AnalysisAI
Authenticated users with variable write permission on Devolutions PowerShell Universal 2026.2.2 and earlier can execute arbitrary PowerShell code on the server by injecting malicious variable values that are not escaped in the configuration file. No public exploit or active exploitation is known (EPSS 0.29%, SSVC exploitation: none), but the vulnerability has a critical CVSS score and the vendor has released a patch in version 2026.2.3.
More in Powershell Universal
View allThe API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary comman
Code injection in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creat
Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with
PowerShell Universal before version 2026.1.4 contains insufficient authorization validation on gRPC endpoints, allowing
The Web Server in Ironman Software PowerShell Universal v3.x and v2.x allows for directory traversal outside of the conf
Devolutions PowerShell Universal 2026.2.0 leaks serialized App Tokens in plaintext within AI Agent job API responses, en
OAuth refresh token disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows authenticated users with
Information disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local attacker with file system
authentication configuration in PowerShell Universal versions up to 2026.1.3 is affected by cleartext storage of sensit
PowerShell Universal versions before 4.5.6 and 5.6.13 contain a stored cross-site scripting vulnerability that allows un
PowerShell Universal versions before 2026.1.4 contain an improper input validation vulnerability in the apps and endpoin
Unauthenticated remote access to user-defined REST endpoint OpenAPI specifications is possible in Devolutions PowerShell
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today