---
id: "CVE-2026-124225"
page: "https://infrastack.ai/live/CVE-2026-124225"
kind: "vulnerability"
aliases: ["CVE-2026-124225"]
title: "Windows PowerShell: code injection lets a local attacker run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "powershell", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:20:48+00:00"
first_seen_at: "2026-11-10T19:25:13+00:00"
updated_at: "2026-11-10T19:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124225", "first_seen_at": "2026-11-10T19:25:13+00:00"}]
exploit_sources: []
---

# Windows PowerShell: code injection lets a local attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-124225 (this .md is for agents)

Windows PowerShell does not properly control how it generates code, so an unauthorized attacker can inject and execute code. The attacker needs to be on the machine, per the NVD description.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PowerShell version with `$PSVersionTable.PSVersion` and compare it with the fixed builds in the Microsoft advisory, which the sources do not list.
- Confirm Windows is patched with Windows Update, since the sources do not name a specific build.

## Timeline

- 2026-11-10T19:25:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124225

## From the sources

Improper control of generation of code ('code injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_