Description
On windows, if I run a curl on powershell for a script that should show <script>alert(1)</script> it just executes the script when it shouldn't.
I did not use AI to find or report this bug.
## Affected version
on CMD I ran curl --version
`curl 8.16.0 (Windows) libcurl/8.16.0 Schannel zlib/1.3.1 WinIDN`
on powershell it didn't recognise the --version flag.
I haven't installed any specific curl version on this computer so it should be the default one that comes and gets updated with windows 11.
## Steps To Reproduce:
1. host an endpoint that will return `<script>alert(1)</script>` (in this case ctf.eztfsp.lv:8009/test.js)
2. open powershell
3. on powershell run `curl ctf.eztfsp.lv:8009/test.js`
4. it opens a a window that states "message from webpage 1"
## Supporting Material/References:
I've attached a .gif where I demonstrate how it works on powershell and how it works on CMD
* [attachment / reference]
## Impact
## Summary:
1. run javascript on powershell curl.
2. It also hangs the process, I wasn't able to control+c to stop the curl process while the alert window was open, so it could potentially be used to hang powershell scripts.
I did not use AI to find or report this bug.
## Affected version
on CMD I ran curl --version
`curl 8.16.0 (Windows) libcurl/8.16.0 Schannel zlib/1.3.1 WinIDN`
on powershell it didn't recognise the --version flag.
I haven't installed any specific curl version on this computer so it should be the default one that comes and gets updated with windows 11.
## Steps To Reproduce:
1. host an endpoint that will return `<script>alert(1)</script>` (in this case ctf.eztfsp.lv:8009/test.js)
2. open powershell
3. on powershell run `curl ctf.eztfsp.lv:8009/test.js`
4. it opens a a window that states "message from webpage 1"
## Supporting Material/References:
I've attached a .gif where I demonstrate how it works on powershell and how it works on CMD
* [attachment / reference]
## Impact
## Summary:
1. run javascript on powershell curl.
2. It also hangs the process, I wasn't able to control+c to stop the curl process while the alert window was open, so it could potentially be used to hang powershell scripts.
Basic Information
ID
H1:3442024
Published
Nov 26, 2025 at 07:35
Modified
Nov 26, 2025 at 09:32