CVE-2026-124225 · Infrastructure
NO FIX YET
Windows PowerShell does not properly control how it generates code, so an unauthorized attacker can inject and execute code. The attacker needs to be on the machine, per the NVD description.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
The NVD description names Windows PowerShell and a local attacker, and gives no affected version ranges or configuration details. Teams running Windows hosts with PowerShell should check their patch level against the vendor advisory. unknown whether any non-default setting is required.
Who cares powershell, windows
$PSVersionTable.PSVersion and compare it with the fixed builds in the Microsoft advisory, which the sources do not list.No fix yet, per the sources.
Improper control of generation of code ('code injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.