azure-cli

Azure Command-Line Interface

View on Pypi

View on Github

Activity

Latest release: 1w ago
Total releases: 208
Cadence: ~27 days
Last 12 months: 15

Reach

Stars: 4.6k

Details

License: MIT
First release: Sep 20, 2016

Releases

Version	Released
`2.90.0` minor	Sep 01, 2026
`2.89.1` patch	Aug 12, 2026
`2.89.0` minor	Aug 04, 2026
`2.88.0` minor	Jul 07, 2026
`2.87.0` minor	Jun 02, 2026
`2.86.0` minor	May 04, 2026
`2.85.0` minor	Apr 07, 2026
`2.84.0` minor	Mar 03, 2026
`2.83.0` minor	Feb 03, 2026
`2.82.0` minor	Jan 13, 2026
`2.66.2` patch	Dec 10, 2025
`2.81.0` minor	Dec 02, 2025
`2.80.0` minor	Nov 18, 2025
`2.79.0` minor	Nov 04, 2025
`2.78.0` minor	Oct 14, 2025
`2.77.0` minor	Sep 02, 2025
`2.76.0` minor	Aug 05, 2025
`2.75.0` minor	Jul 01, 2025
`2.74.0` minor	Jun 03, 2025
`2.73.0` minor	May 19, 2025
`2.72.0` minor	May 06, 2025
`2.71.0` minor	Apr 01, 2025
`2.66.1` patch	Mar 04, 2025
`2.70.0` minor	Mar 04, 2025
`2.69.0` minor	Feb 11, 2025
`2.68.0` minor	Jan 14, 2025
`2.67.0` minor	Nov 19, 2024
`2.66.0` minor	Nov 11, 2024
`2.65.0` minor	Oct 08, 2024
`2.64.0` minor	Sep 03, 2024
`2.63.0` minor	Aug 06, 2024
`2.62.0` minor	Jul 09, 2024
`2.61.0` minor	May 21, 2024
`2.60.0` minor	Apr 30, 2024
`2.59.0` minor	Apr 02, 2024
`2.58.0` minor	Mar 05, 2024
`2.57.0` minor	Feb 06, 2024
`2.56.0` minor	Jan 09, 2024
`2.55.0` minor	Dec 05, 2023
`2.54.0` minor	Nov 14, 2023
`2.53.1` patch	Oct 24, 2023
`2.53.0` minor	Sep 26, 2023
`2.52.0` minor	Sep 05, 2023
`2.51.0` minor	Aug 01, 2023
`2.50.0` minor	Jul 04, 2023
`2.49.0` minor	May 23, 2023
`2.48.1` patch	Apr 25, 2023
`2.48.0` minor	Apr 25, 2023
`2.47.0` minor	Apr 04, 2023
`2.46.0` minor	Mar 07, 2023

1–50 of 208

Repository

azure/azure-cli

Forks: 3.5k
Open issues: 3.6k
Language: Python
: 7.0/ 10

azure
azure-cli
cloud

Dependencies (108)

Depends on

2.90.0

Used by

Supply-chain exposure

79 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2022-39327 GHSA-47xc-9rr2-q7p4 BIT-azure-cli-2022-39327 PYSEC-2022-43177 Oct 25, 2022

Improper Control of Generation of Code ('Code Injection') in Azure CLI

8.1 / 10
High
Network High None None Unchanged High High High

Description

In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source.

For example: Application X is a web application with a feature that allows users to create Secrets in an Azure KeyVault. Instead of constructing API calls based on user input, Application X uses Azure CLI commands to create the secrets. Application X has input fields presented to the user and the Azure CLI command parameter values are filled based on the user input fields. This input, when formed correctly, could potentially be run as system commands. Below is an example of the resulting Azure CLI command run on the web app's hosting machine.

az keyvault secret set --vault-name SomeVault --name foobar --value "abc123|whoami"

The above command could potentially run the whoami command on the hosting machine.

Interactive, in-terminal use and automation/pipeline scenarios have not been identified as critical risk scenarios.

Code injection prerequisites

The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell **and**when the parameter value contains the & or | symbols. If any of these prerequisites are not met, this vulnerability is not applicable.

1. The command has to be run on Windows

The Azure CLI has an entry script that, when run on Windows, calls cmd.exe to then call Python. This leads into the next prerequisite.

2. The command has to be executed by PowerShell.

PowerShell has input parsing designs that strip out the quotation marks of input with the expectation that it will be taken as a string. When used in a PowerShell environment, the command is input like the above command. However, when it passes through PowerShell into cmd.exe, it looks like the following.

az keyvault secret set --vault-name SomeVault --name foobar --value abc123|whoami

This leads to the 3rd prerequisite as it won’t just try to run any parameter value as a command.

3. The parameter value has to contain a & or | symbols

In cmd.exe, the & and | symbols invoke command execution. When a string containing this symbols is passed directly to cmd.exe, quotes are kept and command execution is invoked. However, When a string is passed into PowerShell, the quotes are stripped and passed into cmd.exe making it open to execution.

So, in the keyvault example above, the abc123 portion of the value will be accepted correctly but the value after the | symbol will be interpreted as a command.

Impact

Code injection

As mentioned in the above scenario where the value is being provided by and outside source to run an Azure CLI command, system commands or even scripts could be run on a hosting machine.

Patches

Upgrade to Azure CLI 2.40.0 or greater.

As of Azure CLI 2.40.0, a new .ps1 entry script is used as the entry point to call Python rather than cmd.exe. This removes the opportunity for cmd.exe to interpret input as a command invocation. Using this approach has introduced new issues however that you can read about in the "More information" section.

Upgrade to 2.41.0 or greater and manually call the azps.ps1 entry script in identified critical scenarios.

In Azure CLI 2.41.0 we have reverted back to using the cmd.exe entry script as the default while keeping the azps.ps1 entry script for manual Azure CLI calls if users require it.

C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\wbin\azps.ps1 keyvault secret set --vault-name SomeVault --name foobar --value "abc123|whoami"

More information

PowerShell Parsing with Azure CLI

PowerShell’s input parsing design has caused regressions and issues in Azure CLI’s behavior resulting in broken scripts and pipelines. Below are the known issues and links to GitHub issues. This should not be taken as a complete list since these are only the reported issues. Users should verify command effectiveness before use in production environments.

PowerShell arrays can't be passed to Azure CLI

Argument passthrough token (--) doesn't work with Azure CLI in PowerShell

Stop parsing token (--%) no longer works with Azure CLI in PowerShell

stdin passing is interrupted for Azure CLI in PowerShell

Azure CLI returns 0 when failing in PowerShell

Azure CLI can no longer be invoked by Start-Process

To avoid these breaking changes, in Azure CLI 2.41.0 we have reverted back to using the cmd.exe entry script as the default while keeping the azps.ps1 entry script for manual Azure CLI calls if users require it.

🗒️ The .ps1 entry script is only required for similarly identified scenarios like the example above. Interactive use and automation scenarios have not been identified as high risk.

If the azps.ps1 script is needed, you can call it like this:

C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\wbin\azps.ps1 vm create

If you have any questions or comments about this advisory:

Open an issue in Azure CLI GitHub repo

Email us at AzPyCLI@microsoft.com

Affected versions

0.1.0b100.1.0b110.1.0b40.1.0b70.1.0b80.1.0b90.1.1b10.1.1b20.1.1b30.1.2rc10.1.2rc22.0.0

+ 139 more Show less

2.0.12.0.102.0.122.0.132.0.142.0.152.0.162.0.172.0.182.0.192.0.22.0.202.0.212.0.222.0.232.0.242.0.252.0.262.0.272.0.282.0.292.0.32.0.302.0.312.0.322.0.332.0.342.0.352.0.372.0.382.0.42.0.402.0.412.0.422.0.432.0.442.0.452.0.462.0.472.0.482.0.492.0.52.0.502.0.512.0.522.0.532.0.542.0.552.0.562.0.572.0.582.0.592.0.62.0.602.0.612.0.622.0.632.0.642.0.652.0.662.0.672.0.682.0.692.0.72.0.702.0.712.0.722.0.732.0.742.0.752.0.762.0.772.0.782.0.792.0.82.0.802.0.812.0.92.1.02.10.02.10.12.11.02.11.12.12.02.12.12.13.02.14.02.14.12.14.22.15.02.15.12.16.02.17.02.17.12.18.02.19.02.19.12.2.02.20.02.21.02.22.02.22.12.23.02.24.02.24.12.24.22.25.02.26.02.26.12.27.02.27.12.27.22.28.02.28.12.29.02.29.12.29.22.3.02.3.12.30.02.31.02.32.02.33.02.33.12.34.02.34.12.35.02.36.02.37.02.38.02.39.02.4.02.5.02.5.12.6.02.7.02.8.02.9.02.9.1

Fixed in

2.40.0

References

https://github.com/Azure/azure-cli/security/advisories/GHSA-47xc-9rr2-q7p4
https://nvd.nist.gov/vuln/detail/CVE-2022-39327
https://github.com/Azure/azure-cli/pull/23514
https://github.com/Azure/azure-cli/pull/24015
https://github.com/Azure/azure-cli
https://github.com/pypa/advisory-database/tree/main/vulns/azure-cli/PYSEC-2022-43177.yaml

Updated Jun 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 90
patch 106
pre 11

208 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More