low1.1
CVE-2025-46735
Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`
Impact
## Impact: A security issue has been found in `terraform-provider-windns` before version `1.0.5`. The `windns_record` resource did not santize the input variables. This can lead to authenticated command injection in the underlyding powershell command prompt. ## Patches: [`83ef736 (fix: better input validation)`](https://github.com/nrkno/terraform-provider-windns/commit/c76f69610c1b502f90aaed8c4f102194530b5bce) ## Fixed versions: - `v1.0.5`
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/nrkno/terraform-provider-windns | <= 1.0.4 | none recorded |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/nrkno/terraform-provider-windns/commit/c76f69610c1b502f90aaed8c4f102194530b5bce
- https://github.com/nrkno/terraform-provider-windns/security/advisories/GHSA-4vgf-2cm4-mp7c
- https://github.com/advisories/GHSA-4vgf-2cm4-mp7c
- https://nvd.nist.gov/vuln/detail/CVE-2025-46735