CVE-2026-19768 in PowerShell Universal
Summary
by MITRE • 08/14/2026
Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability represents a critical code injection flaw that exploits improper input validation within the settings management functionality of Devolutions PowerShell Universal version 2026.2.3 and earlier. The issue stems from inadequate sanitization of user-supplied data when processing setting values, creating an environment where maliciously crafted inputs can be executed as PowerShell commands. The vulnerability manifests when authenticated users with appropriate permissions submit specially crafted setting values that bypass normal validation mechanisms, allowing arbitrary PowerShell code execution within the application's runtime context.
The technical implementation of this flaw involves the application's failure to properly escape or sanitize user input before writing configuration data to disk. When legitimate administrative users modify settings through the web interface, the system processes these inputs without adequate filtering or encoding, enabling malicious payloads to persist in the configuration files. This creates a persistent code execution vector that can be triggered during normal application operation when settings are loaded or processed. The vulnerability maps directly to CWE-94, which describes improper control of generation of code, and specifically aligns with ATT&CK technique T1059.001 for command and scripting interpreter usage.
The operational impact of this vulnerability extends beyond simple privilege escalation as it provides attackers with complete control over the PowerShell Universal environment. An authenticated user with settings management permissions can execute arbitrary commands with the privileges of the application process, potentially leading to full system compromise if the application runs with elevated privileges. The persistence aspect of this vulnerability means that malicious code will continue executing whenever the affected configuration is loaded, making detection and remediation more challenging. Attackers could leverage this capability to establish backdoors, exfiltrate data, or pivot to other systems within the network.
Mitigation strategies should focus on implementing robust input validation and sanitization mechanisms throughout the application's configuration handling pipeline. All user-supplied inputs must undergo proper escaping or encoding before being written to configuration files, with particular attention to PowerShell-specific characters that could enable command execution. The principle of least privilege should be enforced by restricting settings management permissions to only those users who absolutely require them. Additionally, regular security assessments and input validation testing should be conducted to identify similar vulnerabilities in other application components. Network segmentation and monitoring solutions should be deployed to detect anomalous PowerShell activity that might indicate exploitation attempts, while automated patch management processes should ensure timely deployment of vendor-provided security updates to address this vulnerability.