nrkno/terraform-provider-windns · Security
Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`
- GHSA ID
- GHSA-4vgf-2cm4-mp7c
- CVE ID
- CVE-2025-46735
- Severity
- low
- Published
- Updated
- CVSS v4
- 1.1 · CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:U
Description
Impact:
A security issue has been found in terraform-provider-windns before version 1.0.5. The windns_record resource did not santize the input variables. This can lead to authenticated command injection in the underlyding powershell command prompt.
Patches:
83ef736 (fix: better input validation)
Fixed versions:
v1.0.5
CWEs
- CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')