---
id: "CVE-2026-116627"
kind: "vulnerability"
aliases: ["CVE-2026-116627"]
title: "PowerShell Universal: notification target URL lets users run browser scripts"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "powershell-universal", "self-hosted", "windows"]
not_affected_if: ["fixed-version", "no-notification-creators"]
published_at: "2026-10-27T13:16:56+00:00"
first_seen_at: "2026-10-27T13:31:51+00:00"
updated_at: "2026-10-27T13:32:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116627", "first_seen_at": "2026-10-27T13:31:51+00:00"}]
---

# PowerShell Universal: notification target URL lets users run browser scripts

Devolutions PowerShell Universal 2026.3.0 and earlier does not sanitize the target URL of notifications. An authenticated user who can create notifications can inject JavaScript that runs in the browser of another user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PowerShell Universal version in the admin console or with the server's package metadata; versions `2026.3.0` and earlier are affected.

## Fix

- Upgrade Devolutions PowerShell Universal to a version later than `2026.3.0`; the exact fixed version is unknown from the sources.
- Until patched, restrict notification creation permission to trusted users.

## Timeline

- 2026-10-27T13:31:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116627

## From the sources

Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_