Local code execution via command injection

Command injection in Microsoft PowerShell before 7.4.19, 7.5.10, and 7.6.5 allows local authenticated users to execute code. Public records identify improper neutralization of special elements in PowerShell command input, but Microsoft has not disclosed the specific command-construction locus or input-handling path that mishandles attacker-controlled data. Exploitation requires local access and existing authorization to run PowerShell, and the published scoring indicates code execution with the privileges of the PowerShell process rather than a separate privilege-escalation primitive.