Security & compliance
Upholding the highest standards to protect your data and ensure trust.
DEVO-2026-0001
PowerShell Universal is affected by a cross-site scripting vulnerability
Affected Products
PowerShell Universal
4.5.5 and earlier, 5.6.12 and earlier
Change Log
2026-01-07 - Initial publication
6.0 Medium - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Cross-site scripting in the Show-UDToast component
The Show-UDToast component does not encode content passed in the Message parameter. This could expose applications to cross-site scripting if user provided data is used.
Affected Products
CVE(s)
CVE-2026-0618
Remediation and Workarounds
In versions prior to 4.5.6 and 5.6.13, apply HTML encoding to content prior to passing it to the Message parameter.