Windows PowerShell Enhances Security Measures for Web Content Downloads

Microsoft has implemented a new warning feature in Windows PowerShell to alert users when running scripts that utilize the Invoke-WebRequest cmdlet for downloading web content. This enhancement aims to mitigate potential risks associated with executing code from unknown sources.

According to Microsoft, this update addresses a high-severity vulnerability in PowerShell, specifically the CVE-2025-54100, which predominantly impacts enterprise or IT-managed environments utilizing PowerShell scripts for automation purposes. The warning is designed to prevent the execution of potentially harmful code, as PowerShell scripts are predominantly utilized within controlled environments.

The latest version of Windows PowerShell, 5.1, now includes this security measure. It is the default PowerShell version on Windows 10 and Windows 11 systems and brings the same secure web parsing process available in PowerShell 7 to older versions.

Users will receive a notification when attempting to run scripts downloaded using the “Invoke-WebRequest’ cmdlet without proper precautions. By default, the operation will be canceled, and users will be prompted to rerun the command with the ‘-UseBasicParsing’ parameter for safer processing.

Choosing ‘Yes’ will allow the page to be parsed using the older method, enabling the content and embedded scripts to load as usual. On the other hand, selecting ‘No’ will halt the operation to safeguard the system from potential threats.

Microsoft explains, “Windows PowerShell 5.1 now displays a security confirmation prompt when using the Invoke-WebRequest command to fetch web pages without special parameters. This prompt warns that scripts in the page could run during parsing and advises using the safer -UseBasicParsing parameter to avoid any script execution. Users must choose to continue or cancel the operation.”

Following the installation of the KB5074204 update, IT administrators will encounter a confirmation prompt highlighting the risks associated with script code execution.

    Security Warning: Script Execution Risk

    Invoke-WebRequest parses the content of the web page. Script code in the web page might be run when the page is parsed.

          RECOMMENDED ACTION:

          Use the -UseBasicParsing switch to avoid script code execution.

          Do you want to continue?

                ```

     

    For more information, refer to [KB5074596: PowerShell 5.1: Preventing script execution from web content](https://support.microsoft.com/help/5072034).

To prevent automation scripts from requiring manual confirmation, administrators are advised to update their scripts to explicitly use the UseBasicParsing safe parameter.

Additionally, it is important to note that in PowerShell, the ‘curl’ command is aliased to the Invoke-WebRequest cmdlet. Therefore, the new warnings will also apply when running scripts involving curl commands.

Microsoft reassures users that the majority of PowerShell scripts and commands utilizing the Invoke-WebRequest command will continue to function without significant modifications. Scripts focused on downloading content or working with textual or data responses remain unaffected and do not require any adjustments.

Enhancing Identity and Access Management (IAM) for Modern Business Needs