CVE-2025-54100

High · 7.8

CVSS

7.8

EPSS

2.2%

Published

Dec 9, 2025

CISA due date

—

The record

Improper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.

Affected packages

Ecosystem	Package	Introduced	Fixed