CVE-2026-116627 in PowerShell Universal
Summary
by MITRE • 10/27/2026
Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified as Improper Neutralization of Input during Web Page Generation, commonly known as Cross-Site Scripting or XSS, affects the notifications feature within Devolutions PowerShell Universal versions 2026.3.0 and earlier. This security flaw arises from an insufficient validation mechanism when processing user-supplied input for notification target URLs. Specifically, the application fails to adequately sanitize or encode special characters that have semantic meaning in HTML and JavaScript contexts before rendering them in web pages generated dynamically based on these inputs. As a result, if an attacker constructs a malicious URL containing executable script payloads, this code can be injected into the page context when another user views the notification associated with that target.
The operational impact of this vulnerability is significant because it allows for the execution of arbitrary JavaScript within the browser session of any authenticated victim who interacts with or views the crafted notification. Since the attack requires an authenticated user with permission to create notifications, the threat actor must first compromise a legitimate account possessing these specific privileges. Once such access is obtained, the attacker can configure a notification target URL that includes malicious script code. When another authorized user accesses their dashboard or notification center and triggers the display of this notification, the browser interprets the injected content as part of the page's native JavaScript environment. This context allows the payload to execute with the same privileges and permissions as the victim’s session, effectively bypassing standard security boundaries like the Same-Origin Policy that typically restrict cross-site interactions.
From a technical classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation Cross-Site Scripting in the OWASP Top Ten category A03:2021-Injection. The root cause lies in the failure to apply appropriate output encoding or context-aware sanitization techniques before inserting user-controllable data into HTML structures. In many modern web applications, input validation is often performed at ingestion time, but without corresponding strict output encoding during rendering, stored XSS vectors remain viable. The specific vector here involves a URL field that is likely rendered directly in an anchor tag or similar element without proper escaping of characters such as angle brackets, quotes, and ampersands, which are essential for breaking out of the HTML attribute context into executable script blocks.
The exploitation scenario maps closely to several techniques within the MITRE ATT&CK framework. The initial access phase involves leveraging valid credentials through social engineering or credential theft to gain notification creation privileges. This corresponds to T1078: Valid Accounts in the Initial Access tactic. Once inside, the act of injecting malicious content into a shared resource like notifications falls under T1195: Supply Chain Compromise if viewed as compromising a trusted component, but more accurately aligns with T1059: Command and Control or specifically T1071.001: Application Layer Protocol: Web Protocols for the delivery mechanism. The execution of arbitrary JavaScript in the victim's browser is categorized under T1204: User Execution if it requires user interaction, which this does, as the victim must view the notification. Furthermore, the potential consequences include session hijacking via cookie theft, keylogging to capture further credentials, or phishing attacks that mimic legitimate application interfaces to harvest sensitive data from other users within the organization.
Mitigation strategies for this vulnerability should focus on both immediate remediation and long-term architectural improvements. The primary fix involves implementing strict output encoding specifically tailored to the context in which user input is rendered. For URL attributes, developers must ensure that special characters are percent-encoded or HTML-entity encoded appropriately so they cannot be interpreted as structural elements of the DOM. Additionally, adopting a Content Security Policy (CSP) can significantly mitigate the impact of successful XSS attacks by restricting the sources from which scripts can be loaded and executed. Implementing CSP directives such as script-src with strict-dynamic or nonce-based validation prevents inline scripts from running unless explicitly authorized, thereby neutralizing many stored XSS payloads even if they are successfully injected into the DOM.
Beyond technical fixes, organizational security posture should address the underlying access control issues that allow a single compromised account to impact other users through shared features like notifications. Principle of least privilege dictates that notification creation permissions should be granted only to those who absolutely require them for their job functions. Regular code reviews focusing on input validation and output encoding patterns are essential to prevent similar vulnerabilities in future releases. Security testing, including both static application security testing (SAST) and dynamic application security testing (DAST), should incorporate specific test cases for stored XSS via notification fields to ensure that new features do not reintroduce these flaws. Finally, users should be educated about the risks of interacting with notifications from potentially untrusted sources within enterprise environments where privilege escalation through shared interfaces is a known attack vector.