PT-2025-6516 · Progress · Progress Telerik Ui For Winui

Published 2025-02-12 · Updated 2026-05-21 · CVE-2024-12251

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress Telerik UI for WinUI versions prior to 2025 Q1 (3.0.0)

Description A command injection attack is possible through improper neutralization of hyperlink elements. This issue allows for a command injection attack, potentially leading to unauthorized execution of commands.

Recommendations For versions prior to 2025 Q1 (3.0.0), update to version 2025 Q1 (3.0.0) or later to resolve the issue. As a temporary workaround, consider restricting the use of hyperlink elements to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-12251

Affected Products

Progress Telerik Ui For Winui

References · 8

• https://osv.dev/vulnerability/CVE-2024-12251 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12251 · Security Note
• https://docs.telerik.com/devtools/winui/security/kb-security-command-injection-cve-2024-12251 · Vendor Advisory
• https://t.me/cveNotify/162798 · Telegram Post
• https://t.me/cveNotify/164462 · Telegram Post
• https://t.me/cvenotify/116855 · Telegram Post
• https://t.me/cvedetector/17902 · Telegram Post
• https://twitter.com/CVEnew/status/1889761654889721900 · Twitter Post