PowerShell

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical - deserialization of untrusted data or code injection, high-quality report │ $15,000 │ $16,000 Critical - authentication issues, improper access control, SSRF, or SQL and command injection │ $12,000 │ $13,000 Important - deserialization of untrusted data or code injection │ $10,000 │ $11,000 Critical - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $8,000 │ $9,000 Important - authentication issues, improper access control, SSRF, or SQL and command injection │ $6,000 │ $7,000 Critical - GitHub Actions in the repository │ $5,000 │ $6,000 Important - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $4,000 │ $5,000 Important - GitHub Actions in the repository │ $3,000 │ $3,750 Moderate and Low, every vulnerability type │ $0 │ $0 Submit a vulnerability CVE history 4 Last 12 months 25 Lifetime Code execution 35 % Access control 25 % Info disclosure 20 % Injection 15 % Latest advisories Loading the feed Overview PowerShell 7 is the cross-platform automation shell and scripting language for Windows, Linux and macOS, and it is the scripting layer underneath Azure Cloud Shell, Azure Automation runbooks, Intune and Configuration Manager scripts, most Windows-centric CI/CD runners including GitHub-hosted Windows runners where pwsh is the default shell, and a very large body of enterprise administrative tooling. Constrained Language Mode and Just Enough Administration are treated as real security boundaries in hardened environments, so a language-mode escape breaks a control that organisations actually rely on rather than a theoretical one; PowerShell is also the single most common living-off-the-land binary in real intrusions, which is why defenders care about its policy surface. Microsoft pays it through the MSRC Researcher Portal on the Open Source Bounty Program, where a high-quality Critical report in the deserialization or code-injection class tops out at $15,000, and sorona.xyz adds 1.25x on top of whatever Microsoft awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The whole of PowerShell/PowerShell , which the program names on its SCOPE list as "PowerShell 7", at Critical or Important severity on the most recent actively maintained branch, with local-machine-only impact payable since Microsoft added PowerShell to the carve-out in June 2026 The language engine: parser, tokenizer, AST, ScriptBlock compilation, and the runspace and pipeline machinery that executes them Constrained Language Mode and the enforcement of the language-mode boundary Execution policy, script signing and Authenticode validation, and the AMSI and transcription hooks defenders rely on Just Enough Administration: session configuration, role capability files, and the constrained endpoints they define PowerShell Remoting over the WinRM and SSH transports, the PSRP protocol itself, and session, endpoint and transport handling Module autoloading, PSModulePath resolution, binary module loading and the assembly load contexts they run in The cmdlets Microsoft ships in the box, including the ones that fetch and parse remote data, walk the filesystem, or serialise and deserialise objects The repository's own build and release GitHub Actions workflows, which the program prices in a band of their own Out of scope Windows PowerShell 5.1 and the inbox Windows component, which belong to Windows servicing Third-party modules from the PowerShell Gallery that Microsoft does not own Microsoft repositories outside the program's fifteen-entry SCOPE list: the standard SECURITY.md pointing at MSRC is a reporting path and funds nothing A defect already covered by another vendor's bounty program, which MSRC declines to pay for a second time Moderate and Low severity, which pay $0 at every report quality Samples, tutorials and quickstart code Documentation-only issues Publicly disclosed issues and dependency-confusion reports Reports Microsoft cannot pay out on: residency in a sanctioned country, or no IRS tax form returned within 30 days of validation, voids the award Most-valued findings Code injection through the parser or ScriptBlock compilation path that gets full-language execution out of input the engine was supposed to treat as data: the code-injection class carries the $15,000 top band here A Constrained Language Mode escape, where a session that policy confined to constrained mode ends up running arbitrary full-language code A Just Enough Administration role-capability bypass that reaches a cmdlet or parameter the endpoint's configuration never granted A remoting endpoint flaw over WinRM or SSH that lets a caller land in a session or a privilege level the configuration did not authorise Module autoloading or PSModulePath resolution that loads attacker-planted code ahead of the intended module Execution policy or Authenticode validation that accepts an unsigned or tampered script as trusted Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. PowerShell 7 only: Windows PowerShell 5.1 is an inbox Windows component and is serviced through Windows, not through this program Only Critical and Important severity qualify; Moderate and Low findings pay $0 under this program Reproduce on the most recent actively maintained branch Local-machine-only impact became payable for PowerShell on 22 June 2026, when Microsoft added it to the carve-out, so a purely local privilege boundary break now counts Follow coordinated vulnerability disclosure: Microsoft requires bounty submissions stay confidential while it fixes, and imposing a fix deadline forfeits eligibility Return an IRS tax form (W-9, W-8BEN or 8233) within 30 calendar days of validation, and expect sanctions screening Disclosure Coordinated through MSRC. PowerShell fixes are usually published through the Microsoft Security Update Guide rather than as repository advisories, so expect the credit and the public detail to appear there on Microsoft's schedule. Because the program's confidentiality terms read directly on third-party disclosure, file with MSRC yourself first and send sorona.xyz the case ID. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability