Summary

PushRunspaceCommand.SetRunspacePrompt() (line 1138, src/System.Management.Automation/engine/remoting/commands/PushRunspaceCommand.cs, current HEAD bf456e85) builds a function global:prompt { … } body by string-interpolating the VM/container name directly into a double-quoted PowerShell string, with no escaping.

Because the result is executed with ps.AddScript(promptFn).Invoke(), any $(…) subexpression embedded in the name is evaluated — once when the function is defined, and again on every subsequent prompt draw, because that is how the host prompt works.

Affected code

// PushRunspaceCommand.cs ~line 1178
string promptFn = StringUtil.Format(RemotingErrorIdStrings.EnterVMSessionPrompt,
    @"function global:prompt { """,
    targetName,          // ← no escaping
    @"PS $($executionContext.SessionState.Path.CurrentLocation)> "" }");

ps.AddScript(promptFn).Invoke();

targetName is set from this.VMName, this.ContainerId, this.Session.ComputerName, or remoteRunspace.ConnectionInfo.ComputerName depending on the parameter set. None of these values are validated or escaped before use. StringUtil.Format is a plain string.Format(CultureInfo.CurrentCulture, …) wrapper with no sanitization (confirmed in StringUtil.cs).

The template in RemotingErrorIdStrings.resx is {0}[{1}]: {2} — slot {1} receives targetName unmodified.

Reproduction (no Hyper-V required)

The following reproduces the exact string-building and execution logic used by the real code path:

$template = "{0}[{1}]: {2}"
$maliciousName = '$(Write-Output "INJECTED @ $(Get-Date -Format o)")'
$arg0 = 'function global:prompt { "'
$arg2 = 'PS $($executionContext.SessionState.Path.CurrentLocation)> " }'

$promptFn = $template -f $arg0, $maliciousName, $arg2
Invoke-Expression $promptFn

prompt   # fires injection #1
prompt   # fires injection #2, different timestamp

Output shows two different timestamps — confirming re-execution on every prompt call, not just at definition time.

Real-world trigger

Any user who can name or rename a Hyper-V VM or Windows Container to a string containing $(…) causes injected code to execute inside the session of any user who runs Enter-PSSession -VMName (or -VMId, -ContainerId) against it. The injected code re-runs after every command typed in that session.

Suggested fix

Option A — escape targetName before interpolation using the API already used correctly elsewhere in the codebase (CodeGeneration.EscapeSingleQuotedStringContent):

string safeName = CodeGeneration.EscapeSingleQuotedStringContent(targetName);
string promptFn = StringUtil.Format(RemotingErrorIdStrings.EnterVMSessionPrompt,
    @"function global:prompt { '",
    safeName,
    @"' + "" PS $($executionContext.SessionState.Path.CurrentLocation)> "" }");

Option B — stop building the prompt as script text. Pass targetName into the runspace as a variable and reference it from a script block, so it is never evaluated as PowerShell syntax.

Affected files

• src/System.Management.Automation/engine/remoting/commands/PushRunspaceCommand.cs (SetRunspacePrompt() line 1138; VMName property line 158)
• src/System.Management.Automation/resources/RemotingErrorIdStrings.resx (EnterVMSessionPrompt key)
• src/System.Management.Automation/utils/StringUtil.cs (Format overloads)