This vulnerability (CWE-94) arises from improper control over code generation in the scheduling functionality of Devolutions PowerShell Universal. Specifically, schedule parameter names are concatenated into a PowerShell script invocation without sufficient validation or sanitization, enabling an authenticated user with schedule creation rights to inject and execute arbitrary PowerShell commands. The affected versions include 2026.2.2 and all earlier releases. No CVSS score or vendor remediation details have been published yet.

An attacker who is authenticated and has schedule creation permissions can execute arbitrary PowerShell code on the affected system. This could lead to unauthorized code execution within the context of the application, potentially compromising system integrity or confidentiality depending on the privileges of the application process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict schedule creation permissions to trusted users only to reduce the risk of exploitation.