Azure Pipelines
Monthly
Command injection in Microsoft Azure Pipelines permits remote, unauthenticated code execution with high confidentiality and integrity impact, and the independent assessment also rates availability impact as high (CVSS base 9.1). The CPE identifies microsoft:azure_pipelines without a version restriction, and the available sources do not name the specific pipeline feature, input field, or deployment mode that carries the injectable parameter. A vendor patch is available; active exploitation is not confirmed by CISA KEV, although the CVSS temporal metric E:P indicates proof-of-concept exploit code is assessed to exist.
Command injection in Microsoft Azure Pipelines permits remote, unauthenticated code execution with high confidentiality and integrity impact, and the independent assessment also rates availability impact as high (CVSS base 9.1). The CPE identifies microsoft:azure_pipelines without a version restriction, and the available sources do not name the specific pipeline feature, input field, or deployment mode that carries the injectable parameter. A vendor patch is available; active exploitation is not confirmed by CISA KEV, although the CVSS temporal metric E:P indicates proof-of-concept exploit code is assessed to exist.