7.8
High
CVE-2026-50523 Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an…
Description
Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code locally.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| PowerShell 7.4 7.4 | 7.4.0 → < 7.4.19.0 | 7.4.19.0 |
| PowerShell 7.5 7.5 | 7.5.0 → < 7.5.10.0 | 7.5.10.0 |
| PowerShell 7.6 7.6 | 7.6.0 → < 7.6.5 | 7.6.5 |
References
- Microsoft PowerShell Remote Code Execution Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of PowerShell 7.4
The 22 CVEs of PowerShell 7.4 →
CVE-2026-96303
Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a…
6.5
Medium
CVE-2026-96251
Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute…
8.8
High
CVE-2026-70337
Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network
8.8
High
CVE-2026-70338
Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to…
7.8
High