CVE-2025-46735
Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`
Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found in Terraform WinDNS Provider before version `1.0.5`. The `windns_record` resource did not sanitize the input variables. This could lead to authenticated command injection in the underlyding powershell command prompt. Version 1.0.5 contains a fix for the issue.
Reserved 2025-04-28 | Published 2025-05-06 | Updated 2025-05-06 | Assigner GitHub_MCWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
github.com/...windns/security/advisories/GHSA-4vgf-2cm4-mp7c
github.com/...ommit/c76f69610c1b502f90aaed8c4f102194530b5bce
Support options
