{"id":39273,"date":"2025-12-10T13:44:31","date_gmt":"2025-12-10T18:44:31","guid":{"rendered":"https:\/\/www.yorku.ca\/uit\/?p=39273"},"modified":"2025-12-10T13:53:16","modified_gmt":"2025-12-10T18:53:16","slug":"powershell-remote-code-execution-cve-2025-54100","status":"publish","type":"post","link":"https:\/\/www.yorku.ca\/uit\/2025\/12\/powershell-remote-code-execution-cve-2025-54100\/","title":{"rendered":"PowerShell Remote Code Execution (CVE-2025-54100)"},"content":{"rendered":"
\n
\n
\n

 <\/o:p><\/span><\/p>\n

\n\n\n\n
\n\n\n\n\n
<\/td>\n<\/tr>\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n\n
<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n
\n\n\n\n
\n\n\n\n
\n\n\n\n\n\n
\n

\"A<\/span><\/o:p><\/span><\/p>\n

 <\/o:p><\/span><\/p>\n

Service Advisory<\/span><\/b><\/o:p><\/span><\/p>\n


Microsoft has released security updates to address a vulnerability in Windows PowerShell (CVE-2025-54100) that could allow local users to execute arbitrary code when using the Invoke-WebRequest cmdlet.
<\/span>
Severity level<\/span><\/b>:
<\/span><\/b>CVSS Score: 7.8\/high

Description<\/b>:
CVE-2025-54100 is a command injection vulnerability in Windows PowerShell, specifically affecting the Invoke-WebRequest cmdlet. The flaw occurs because PowerShell automatically parses HTML content using the MSHTML engine, which can inadvertently execute embedded scripts during parsing. This behavior allows attackers to craft malicious web content that, when processed by Invoke-WebRequest, could lead to unintended script execution. Exploitation requires local access and user interaction, such as running a script that invokes Invoke-WebRequest on a malicious URL.<\/o:p><\/span><\/span><\/p>\n

 <\/o:p><\/span><\/p>\n

 <\/o:p><\/span><\/p>\n

Affected Versions:
<\/span><\/span><\/b>All systems using Windows PowerShell 5.1 on vulnerable Windows versions.<\/p>\n

Windows 10.
Windows 11.
Windows Server (2008 through 2025 editions).

Impact:
<\/b>Successful exploitation of this vulnerability may allow attackers to execute arbitrary code on the affected system. <\/p>\n

After applying the patch, users will receive a security warning prompt before parsing any web content that could execute scripts.
<\/span>
Resolution:
<\/span><\/b>Please apply the latest Security updates released by Microsoft.
<\/span>
Reference:<\/span><\/b><\/o:p><\/span><\/p>\n

https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-54100<\/span><\/a><\/span><\/o:p><\/span><\/p>\n

https:\/\/msrc.microsoft.com\/update-guide\/en-US\/advisory\/CVE-2025-54100<\/span><\/a><\/o:p><\/span><\/p>\n

https:\/\/www.cyber.gc.ca\/en\/alerts-advisories\/microsoft-security-advisory-december-2025-monthly-rollup-av25-822<\/span><\/a><\/span><\/o:p><\/span><\/p>\n

https:\/\/thehackernews.com\/2025\/12\/microsoft-issues-security-fixes-for-56.html<\/span><\/a><\/span><\/o:p><\/span><\/p>\n

 <\/o:p><\/span><\/p>\n

<\/p>\n

<\/span>UIT Information Security<\/span> <\/o:p><\/span><\/p>\n

<\/p>\n

Contact <\/span><\/b><\/o:p><\/span><\/p>\n

IT Client Services at askIT@yorku.ca<\/a><\/a> or 416 736 5800 <\/o:p><\/span><\/span><\/p>\n<\/td>\n<\/tr>\n

\n

 <\/o:p><\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n

\n\n\n\n
\n\n\n\n\n
\n

 <\/o:p><\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n

\n\n\n\n
\n\n\n\n
\n\n\n\n\n
<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n\n\n\n
\n

PRIVACY POLICY<\/span><\/a><\/span> | <\/span>VISIT WWW.YORKU.CA<\/span><\/a>
This email was sent by: York University, 4700 Keele Street, Toronto, Ontario M3J 1P3<\/b> <\/span><\/o:p><\/span><\/p>\n

This email is viewed best in Microsoft Outlook for web <\/span><\/o:p><\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n

 <\/o:p><\/span><\/p>\n

 <\/o:p><\/span><\/p><\/div>\n<\/p><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    Service Advisory Microsoft has released security updates to address a vulnerability in Windows PowerShell (CVE-2025-54100) that could allow local users to execute arbitrary code when using the Invoke-WebRequest cmdlet. Severity level: CVSS Score: 7.8\/high Description: CVE-2025-54100 is a command injection vulnerability in Windows PowerShell, specifically affecting the Invoke-WebRequest cmdlet. The flaw occurs because […]<\/p>\n","protected":false},"author":212,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","footnotes":""},"categories":[29],"tags":[],"class_list":["post-39273","post","type-post","status-publish","format-standard","hentry","category-news"],"taxonomy_info":{"category":[{"value":29,"label":"News"}]},"featured_image_src_large":false,"author_info":{"display_name":"aalaily","author_link":"https:\/\/www.yorku.ca\/uit\/author\/aalaily\/"},"comment_info":"","category_info":[{"term_id":29,"name":"News","slug":"news","term_group":0,"term_taxonomy_id":3,"taxonomy":"category","description":"","parent":0,"count":481,"filter":"raw","cat_ID":29,"category_count":481,"category_description":"","cat_name":"News","category_nicename":"news","category_parent":0}],"tag_info":false,"_links":{"self":[{"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/posts\/39273","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/users\/212"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/comments?post=39273"}],"version-history":[{"count":0,"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/posts\/39273\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/media?parent=39273"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/categories?post=39273"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yorku.ca\/uit\/wp-json\/wp\/v2\/tags?post=39273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}