This vulnerability involves improper control of code generation (CWE-94) in the settings feature of Devolutions PowerShell Universal. Authenticated users who have permission to manage settings can exploit this flaw by crafting setting values that inject arbitrary PowerShell code. The injected code is executed because the application does not properly escape these values when saving them to the settings configuration file. No patch or remediation information is currently available, and no known exploits are reported in the wild.

An authenticated user with settings management permissions can execute arbitrary PowerShell code on the system running PowerShell Universal. This could lead to unauthorized code execution, potentially compromising the system or escalating privileges depending on the environment and user permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict settings management permissions to trusted users only and monitor for suspicious activity related to settings changes.