CVE-2026-19768
HighCVSS 8.1Summary
In Devolutions PowerShell Universal version 2026.2.3 and earlier, a code injection vulnerability exists in the settings feature. An authenticated user with settings management permission can execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.
Risk Assessment
An authenticated user with settings management permission can execute arbitrary PowerShell code on the server, potentially leading to full system compromise, data theft, or further network attacks.
Recommendation
Upgrade Devolutions PowerShell Universal to a version newer than 2026.2.3 that fixes the issue. Also restrict settings management permissions to trusted users only.
Original NVD description (English source)
Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.