---
id: CVE-2026-116627
title: >-
  Improper neutralization of input during web page generation ('Cross-site
  Scripting') in the notifications feature in Devolutions PowerShell Universal
  2026.3.0 and earlier allows an authenticated user with notification creation
  permission…
summary: >-
  Improper neutralization of input during web page generation ('Cross-site
  Scripting') in the notifications feature in Devolutions PowerShell Universal
  2026.3.0 and earlier allows an authenticated user with notification creation
  permission…
severity: none
cwe:
  - CWE-79
vendor: Devolutions
product: PowerShell Universal
affected:
  - powershell_universal < 2026.3.1
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T12:45:34.223Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116627'
references:
  - url: 'https://devolutions.net/security/advisories/DEVO-2026-0038/'
tags:
  - cve.org
ingestedAt: '2026-10-27T16:11:59.329Z'
---

## Overview

Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL.

## Affected

- `powershell_universal < 2026.3.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.