Skip to content

Security: kittrellbj/temporary-powershell-2.0

Security

SECURITY.md

Security Policy

Supported Versions

Security fixes are provided for the latest commit on the default branch.

Scope and Risk Notes

This repository is a compatibility utility that temporarily enables legacy PowerShell 2.0 components.

Important considerations:

  • PowerShell 2.0 is legacy and should only be enabled for the shortest possible time.
  • This project requires administrator privileges and modifies both GAC and HKLM registry state.
  • Use only on systems where legacy installer compatibility is required.
  • Disable PowerShell 2.0 support when you are finished with it.

Reporting a Vulnerability

Please do not open public GitHub issues for suspected security vulnerabilities with PowerShell 2.0 or those easily nullified. We are already aware that PowerShell 2.0 has vulnerabilities, but sometimes you can't wait for vendors to update legacy installers.

To report a vulnerability with these files:

  1. Email: inquiries@exteran.com
  2. Subject: TogglePS2 Security Report
  3. Include:
    • Affected commit/tag
    • Reproduction steps
    • Expected vs actual behavior
    • Impact assessment
    • Any logs or screenshots that help reproduce safely

You should receive an initial response within 30 calendar days if a response is required, or we might simply fix the code without responding. If the security vulnerability is easily nullified (i.e. performing the work offline or with firewall enabled), the code might not be updated and instead a notice posted to the ReadMe notifying users of the recommended workflow.

Coordinated Disclosure

  • Please allow time for investigation and remediation before public disclosure.
  • After a fix is available, coordinated public disclosure is welcome.

Hardening Guidance for Users

  1. Run this tool only from a trusted local copy.
  2. Verify repository integrity before execution.
  3. Enable legacy components only immediately before required installs.
  4. Disable legacy components immediately after completion.
  5. Keep operation logs for audit/incident review.

There aren't any published security advisories