GitHub Advisoryadvisory · Go

GHSA-4vgf-2cm4-mp7c Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`

LOW Published 2025-05-06 Modified 2025-05-06 Official page ↗
Aliases
CVE-2025-46735
Ecosystem
Go
Packages
github.com/nrkno/terraform-provider-windns
Severity
Low
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:U
Weaknesses
CWE-77
Reviewed
2025-05-06

Affected packages

• Go github.com/nrkno/terraform-provider-windns: <= 1.0.4 (no fix yet)

Description

Impact: A security issue has been found in `terraform-provider-windns` before version `1.0.5`. The `windns_record` resource did not santize the input variables. This can lead to authenticated command injection in the underlyding powershell command prompt. Patches: `83ef736 (fix: better input validation)` Fixed versions: • `v1.0.5`

Related

Alias · CVE (1)

  • CVE-2025-46735 Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References