7.8
High
CVE-2026-70338 Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to…
Description
Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| PowerShell 7.4 7.4 | 7.4.0 → < 7.4.19.0 | 7.4.19.0 |
| PowerShell 7.5 7.5 | 7.5.0 → < 7.5.10.0 | 7.5.10.0 |
| PowerShell 7.6 7.6 | 7.6.0 → < 7.6.5 | 7.6.5 |
References
- Microsoft PowerShell Security Feature Bypass Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of PowerShell 7.4
The 22 CVEs of PowerShell 7.4 →
CVE-2026-96303
Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a…
6.5
Medium
CVE-2026-96251
Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute…
8.8
High
CVE-2026-50523
Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an…
7.8
High
CVE-2026-70337
Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network
8.8
High