Security advisories

DetentShell 1.1.0.0 security update

Published: November 5, 2026.
Affected: DetentShell 1.0.4.0 and earlier.
Fixed in: DetentShell 1.1.0.0, from the Microsoft Store.
Action: update to 1.1.0.0. Help > About shows the installed version.

Fixes in DetentShell

• WDAC and AppLocker: under an enforced script policy, the console and script tabs ran in FullLanguage. They now run in ConstrainedLanguage, as pwsh.exe does. Computers without an enforced policy weren’t affected.
• Execution policy: the PowerShell 7 tabs ran under RemoteSigned at Process scope, which outranks AllSigned or Restricted set at the CurrentUser or LocalMachine scope, and Windows PowerShell 5.1 scripts ran under Bypass. Both engines now keep AllSigned or Restricted and otherwise use RemoteSigned. DetentShell never changed the computer’s or user’s policy settings. Execution policy set by Group Policy applied before and after this update.
• Start PowerShell 7 started the first pwsh.exe on the PATH without checking it. It now checks for Microsoft’s signature before starting the program and explains any refusal. For the Microsoft Store version of PowerShell, whose pwsh.exe on the PATH is an app execution alias, it checks the installed pwsh.exe the alias points to.

Updated Microsoft components

• PowerShell engine 7.6.6 to 7.6.9, with Microsoft’s fixes for CVE-2026-96251 and CVE-2026-96303.
• .NET runtime 10.0.8 to 10.0.14, with the .NET security fixes in 10.0.9 through 10.0.14, including CVE-2026-111497. Windows Update doesn’t patch an app’s private copy of .NET.

Known limits

• Helper sessions for formatting, script analysis and help lookup stay in FullLanguage.
• Start PowerShell 7 refuses launchers installed by scoop or as a .NET tool, which aren’t Microsoft-signed.
• A short interval remains between the signature check and the start of pwsh.exe.
• A change to the PowerShell 7 execution policy applies the next time DetentShell starts.
• With no execution policy set anywhere, both engines use RemoteSigned, where stock Windows PowerShell 5.1 on Windows 10 and 11 uses Restricted. To keep Restricted, set it explicitly.

Contact: security@detentpoint.com

The full 1.1.0.0 release entry in the changelog →