The vulnerability is a classic cross-site scripting flaw caused by failure to properly neutralize user input during web page generation in the notifications feature of Devolutions PowerShell Universal. An attacker who can create a notification can embed arbitrary JavaScript in the notification target URL. When a legitimate user opens or views the notification, the malicious script runs in that user’s browser, enabling the attacker to perform any action that the victim’s authenticated session permits, including session hijacking, credential theft, or malicious data manipulation.

Devolutions PowerShell Universal 2026.3.0 and all earlier releases.

The flaw is only exploitable by users who hold notification‑creation permission, so operational exposure depends on how many users have that capability. Because the attack requires no additional external credentials and exploits a web‑based interface, the risk is high for environments where credentials are broad or shared. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, but the severity implied by XSS and the ability to inject code directly into other users’ browsers suggests a high‑risk posture.