This vulnerability arises from improper control of code generation in the settings feature of Devolutions PowerShell Universal 2026.2.3 and earlier. An authenticated user with permission to manage settings can inject arbitrary PowerShell code via crafted setting values that are not properly escaped when written to the configuration file. This leads to code injection (CWE-94), enabling execution of arbitrary commands with the privileges of the application.

Successful exploitation allows an authenticated user with settings management permissions to execute arbitrary PowerShell code, resulting in high impact on confidentiality and integrity of the system. Availability is not affected. The vulnerability requires network access and low attack complexity but does require privileges to manage settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict settings management permissions to trusted users only to reduce risk of exploitation.