Security Notice · 3 November 2026
Licence values in the Borian Windows console could run as PowerShell. Fixed in Borian 1.1.12.
A security issue has been found in the licence-processing path of the Borian Windows console. A specially crafted licence key, or licence-file path, containing typographic quote characters that PowerShell recognises (‘ ’ ‚ ‛) could cause unintended PowerShell commands to run in the console's process context.
Exploitation requires authenticated administrator access to the local Borian console. The console listens on 127.0.0.1 only and checks a CSRF token on every form. Remote unauthenticated exploitation has not been demonstrated.
The same issue could also make an ordinary licence key fail to activate when it was pasted with typographic quotes, for example from an email.
Upgrade to Borian 1.1.12, in place, using the .msi. Nothing needs reconfiguring. Borian 1.1.12 is the
only Borian release currently offered for download, from the
Borian releases page. Older releases may be retained for
provenance, but should not be used.
1.1.12 also corrects two smaller console issues: reports now show the actual Windows edition instead of “Windows”, and non-ASCII text in licence messages is no longer garbled.