CVE-2025-46735 Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`
Authenticated attackers can execute arbitrary commands via unsanitized input in the Terraform WinDNS Provider's windns_record resource.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-46735?
CVE-2025-46735 is a low-severity command injection vulnerability in nrkno terraform-provider-windns, published on 6 May 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found in Terraform WinDNS Provider before version `1.0.5`. The `windns_record` resource did not sanitize the input variables. This could lead to authenticated command injection in the underlyding powershell command prompt. Version 1.0.5 contains a fix for the issue.
Weakness: CWE-77
Which versions are affected by CVE-2025-46735?
3 open source packages ship an affected version, including github.com/nrkno/terraform-provider-windns.
| Package | Affected | Fixed in |
|---|---|---|
github.com/nrkno/terraform-provider-windns Go | All versions | None |
github.com/nrkno/terraform-provider-windns Go | All versions to 1.0.4 | None |
github.com/nrkno/terraform-provider-windns Go | All versions to 1.0.4 | None |
How do I fix CVE-2025-46735?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-46735 being exploited?
There is no known exploitation of CVE-2025-46735 in the wild and no public exploit code.
Sources
Also known as GHSA-4vgf-2cm4-mp7c, GO-2025-3670.