Only the latest release on the default branch is supported. wslcompact is a single script; the fix for any issue is to re-run the installer or the one-liner, which always fetches the current version.

Please do not open a public issue for a security problem.

Report privately through GitHub:

1. Go to the Security tab
2. Choose Report a vulnerability

Or email bigun.md@gmail.com with wslcompact security in the subject.

Please include:

• What an attacker can achieve, and what access they need to start
• Steps to reproduce, or a proof of concept
• The wslcompact version, Windows build, and PowerShell version

You can expect an acknowledgement within a few days. If the report is valid, you will get an estimated fix timeline and credit in the advisory unless you prefer to stay anonymous.

This tool runs elevated, deletes files, and executes shell code inside WSL distributions, so the interesting areas are:

• Command or argument injection into the shell scripts staged in the guest, particularly via distro names or the -ProjectRoot value
• Path handling flaws that could cause deletion outside the intended target, for example weaknesses in the CACHEDIR.TAG guard that protects non-Cargo target/ directories
• Privilege escalation through the self-elevation path, including the branch that re-downloads the script when running from irm | iex
• Insecure fetching of the script or installer, such as anything permitting a downgrade or a man-in-the-middle substitution
• Writable install locations that would let a lower-privileged user replace the script that later runs elevated

• Data loss from -PruneVolumes. That flag is documented as destructive, defaults to off, and prompts before running.
• Data loss from -Clean removing caches. Rebuilding is the expected cost.
• The fact that the tool requires administrator rights. Compacting a virtual disk cannot be done without them.
• Piping a remote script to iex. It is opt-in, the URL is pinned to this repository over HTTPS, and the installer verifies the payload before writing it. Users who prefer not to can clone the repo and run the file directly.

The one-liners execute code straight from GitHub. If you would rather inspect first:

irm https://raw.githubusercontent.com/bigunmd/wslcompact/master/wslcompact.ps1 -OutFile wslcompact.ps1
# read it, then:
powershell -ExecutionPolicy Bypass -File .\wslcompact.ps1 -ListOnly

-ListOnly and -DryRun make no changes and do not elevate.