Skip to content

Document breaking change from CVE #12587

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sdwheeler merged 1 commit into from
Dec 16, 2025
Merged

Document breaking change from CVE #12587

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 24 additions & 3 deletions reference/5.1/Microsoft.PowerShell.Utility/Invoke-WebRequest.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
external help file: Microsoft.PowerShell.Commands.Utility.dll-Help.xml
Locale: en-US
Module Name: Microsoft.PowerShell.Utility
ms.date: 10/29/2025
ms.date: 12/16/2025
online version: https://learn.microsoft.com/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-5.1&WT.mc_id=ps-gethelp
schema: 2.0.0
aliases:
Expand Down Expand Up @@ -39,8 +39,29 @@ This cmdlet was introduced in Windows PowerShell 3.0.

> [!WARNING]
> By default, `Invoke-WebRequest` parses the content of the web page. Script code in the web page
> might be run when the page is parsed. Use the `-UseBasicParsing` switch to avoid script code
> execution.
> might be run when the page is parsed. On **December 9, 2025**, Microsoft released a security
> update for [CVE-2025-54100](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54100)
> that changes the default behavior of `Invoke-WebRequest`. After you install the updates, when you
> use the `Invoke-WebRequest` command you see the following confirmation prompt with security
> warning of script execution risk:
>
Comment thread
sdwheeler marked this conversation as resolved.
> ```
> Security Warning: Script Execution Risk
> Invoke-WebRequest parses the content of the web page. Script code in the web page might be
> run when the page is parsed.
> RECOMMENDED ACTION:
> Use the -UseBasicParsing switch to avoid script code execution.
> Do you want to continue?
> ```
>
> To avoid the confirmation prompt, you must use the **UseBasicParsing** parameter. There is no way
> to bypass this prompt without using the **UseBasicParsing** parameter. If you answer "Y" to the
Comment thread
sdwheeler marked this conversation as resolved.
> prompt, the command runs with full parsing of the web page content, which could run script code in
> the web page.
>
> For more information about this security update, see
> [PowerShell 5.1: Preventing script execution from web content](https://support.microsoft.com/KB/5074596).


This command can be run using the `iwr`, `curl`, or `wget` aliases.

Expand Down