{"id":"CVE-2026-113609","published":"2026-10-20T16:17:11.320","lastModified":"2026-10-20T17:17:35.310","description":"Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.","cvssScore":3.3,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwes":["CWE-693"],"vendors":[],"products":[],"references":[{"url":"https://en.bandisoft.com/bandizip/history/","tags":[]},{"url":"https://www.vulncheck.com/advisories/bandisoft-bandizip-before-7.47-mark-of-the-web-bypass-for-powershell-scripts","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}