{"id":"CVE-2026-116627","kind":"vulnerability","aliases":["CVE-2026-116627"],"related":[],"title":"PowerShell Universal: notification target URL lets users run browser scripts","description":"Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL.","summary":"Devolutions PowerShell Universal 2026.3.0 and earlier does not sanitize the target URL of notifications. An authenticated user who can create notifications can inject JavaScript that runs in the browser of another user.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","powershell-universal","self-hosted","windows"],"not_affected_if":["fixed-version","no-notification-creators"],"how_to_check":"- Check the installed PowerShell Universal version in the admin console or with the server's package metadata; versions `2026.3.0` and earlier are affected.","fix":"- Upgrade Devolutions PowerShell Universal to a version later than `2026.3.0`; the exact fixed version is unknown from the sources.\n- Until patched, restrict notification creation permission to trusted users.","status":"open","published_at":"2026-10-27T13:16:56+00:00","first_seen_at":"2026-10-27T13:31:51+00:00","triaged_at":"2026-10-27T13:32:27+00:00","updated_at":"2026-10-27T13:32:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T13:32:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Devolutions PowerShell Universal to a version later than `2026.3.0`; the exact fixed version is unknown from the sources.\n- Until patched, restrict notification creation permission to trusted users.","reach":"network","title":"PowerShell Universal: notification target URL lets users run browser scripts","impact":"medium","summary":"Devolutions PowerShell Universal 2026.3.0 and earlier does not sanitize the target URL of notifications. An authenticated user who can create notifications can inject JavaScript that runs in the browser of another user.","category":"package","nicknames":[],"who_cares":["powershell-universal","self-hosted","windows"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs JavaScript in another user's browser session","analyst_note":"Confirm the fixed version and whether a victim must open the notification, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-116627 or the vendor advisory.","how_to_check":"- Check the installed PowerShell Universal version in the admin console or with the server's package metadata; versions `2026.3.0` and earlier are affected.","needs_analyst":true,"not_affected_if":["fixed-version","no-notification-creators"],"who_is_affected":"Teams running Devolutions PowerShell Universal `2026.3.0` or earlier where some users can create notifications. Exposure depends on users with notification creation rights able to target other users; the sources do not say whether default configuration is affected. Instances on a fixed version can skip this.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000619,"input_tokens":3312,"output_tokens":576,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116627':13A,16A '-2026':12A,15A '2026.3.0':28B,77C 'allow':80C 'anoth':55B,96C 'arbitrari':90C 'authent':40B,82C 'browser':9A,53B,94C 'craft':100C 'creat':44B 'creation':86C 'cross':66C 'cross-sit':65C 'cve':11A,14A 'devolut':25B,74C 'earlier':30B,79C 'execut':89C 'featur':72C 'generat':64C 'host':23B 'improp':57C 'inject':47B 'input':60C 'javascript':48B,91C 'let':6A 'neutral':58C 'notif':3A,38B,45B,71C,85C,101C 'packag':17B 'page':63C 'permiss':87C 'powershel':1A,19B,26B,75C 'powershell-univers':18B 'run':8A,50B 'sanit':33B 'script':10A,68C 'self':22B 'self-host':21B 'site':67C 'target':4A,35B,102C 'univers':2A,20B,27B,76C 'url':5A,36B,103C 'user':7A,41B,56B,83C,97C 'via':98C 'web':62C 'window':24B","nicknames":[],"mitigations":[],"who_affected":"Teams running Devolutions PowerShell Universal `2026.3.0` or earlier where some users can create notifications. Exposure depends on users with notification creation rights able to target other users; the sources do not say whether default configuration is affected. Instances on a fixed version can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T13:16:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116627","severity":null,"published_at":"2026-10-27T13:16:56+00:00","modified_at":"2026-10-27T13:16:56+00:00","first_seen_at":"2026-10-27T13:31:51+00:00","fetched_at":"2026-10-27T13:31:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}