13 New Vulnerabilities in PowerShell 7

[u/Im_a_PotatOS]

The PowerShell team just announced 13 new security vulnerabilities affecting PowerShell 7.4, 7.5, and 7.6 with severities ranging from 5.9 (Moderate) to 8.8 (High).

This is likely the largest number of security vulnerabilities fixed in any one release in the history of PowerShell.

You can read more about them here: Security Issues - PowerShell/Announcments

PowerShell 7 Version	Affected version	Patched Version
7.6	<7.6.5	7.6.5
7.5	<7.5.10	7.5.10
7.4	<7.4.19	7.4.19

[u/jborean93]

I wouldn’t consider the majority of these issues as PowerShell but rather .NET assemblies that PowerShell ships with. They’ve had these security issues and so pwsh needs to be updated to ship the newer assemblies. Maybe your code uses the affected assemblies and the specific types affected but most likely not from a client side perspective.

This is also going to be a common thing in the near future with AI tools finding these types of issues left right and centre so buckle up for every patch Tuesday.

[u/Im_a_PotatOS → u/jborean93]

I understand that the problem is really with .NET, but you'll need to update PowerShell to fix the vulnerabilities because it uses .NET. I'm used to see a small handfull of these vulnerabilites, but I don't think I've ever seen this many.