Vm Repair
Monthly
Command injection (CWE-77) in Microsoft Azure CLI versions 1.0.0 through 2.2.0 allows a low-privilege authenticated attacker to execute arbitrary commands over a network when user interaction is obtained. The Scope Changed attribute in the CVSS vector indicates injected commands can break out of the CLI security context and affect resources beyond the immediate process - likely Azure resource management operations or the underlying host OS. Vendor patch is available at version 2.2.1; no public exploit code or CISA KEV listing has been identified at time of analysis.
Command injection (CWE-77) in Microsoft Azure CLI versions 1.0.0 through 2.2.0 allows a low-privilege authenticated attacker to execute arbitrary commands over a network when user interaction is obtained. The Scope Changed attribute in the CVSS vector indicates injected commands can break out of the CLI security context and affect resources beyond the immediate process - likely Azure resource management operations or the underlying host OS. Vendor patch is available at version 2.2.1; no public exploit code or CISA KEV listing has been identified at time of analysis.