CVE-2026-25925: Modery PowerDocu RCE Vulnerability

CVE-2026-25925 Overview

CVE-2026-25925 is an insecure deserialization vulnerability in PowerDocu, a Windows GUI executable used to generate technical documentation for Power Platform Flows and Apps. Versions prior to 2.4.0 blindly trust the $type property in JSON files contained within Flow or App packages. An attacker who convinces a user to process a crafted package can instantiate arbitrary .NET objects and execute code in the context of the PowerDocu process. The flaw is tracked under [CWE-502: Deserialization of Untrusted Data]. Maintainers fixed the issue in PowerDocu 2.4.0.

Critical Impact
Processing a malicious Flow or App package in a vulnerable PowerDocu build leads to arbitrary .NET object instantiation and local code execution under the running user's privileges.

Affected Products

Modery PowerDocu versions prior to 2.4.0
Windows GUI executable distribution of PowerDocu
Any workflow that ingests untrusted Power Platform Flow or App packages

Discovery Timeline

2026-02-09 - CVE-2026-25925 published to NVD
2026-02-28 - Last updated in NVD database

Technical Details for CVE-2026-25925

Vulnerability Analysis

PowerDocu parses JSON definitions extracted from Power Platform Flow and App packages to generate documentation artifacts. The parser honors the $type metadata property used by Json.NET (Newtonsoft.Json) to drive polymorphic deserialization. When TypeNameHandling is set to a permissive value such as Auto or All, the deserializer resolves the supplied type string and constructs the corresponding .NET object graph.

An attacker can supply a $type value that references a gadget class with side effects in its constructor, property setters, or deserialization callbacks. Known gadget chains in the .NET ecosystem allow command execution, file write primitives, and process spawning during object construction. Because PowerDocu executes locally on an analyst workstation, successful exploitation yields code execution with the privileges of the user running the tool.

Exploitation requires user interaction: the victim must open or process the malicious package. The attack vector is local, but the package can be delivered through any channel that transports Flow or App exports, including email, source control, or shared storage.

Root Cause

The root cause is unrestricted polymorphic deserialization. PowerDocu does not constrain the set of types the JSON deserializer may instantiate and does not validate the structure of incoming Flow or App JSON before passing it to the deserializer. This pattern matches [CWE-502] and is the same class of issue documented across many Newtonsoft.Json misuses.

Attack Vector

An attacker crafts a Flow or App package containing a JSON document with a malicious $type directive pointing to a dangerous .NET type. The attacker distributes the package and convinces a user to process it with a vulnerable PowerDocu build. When PowerDocu deserializes the JSON, the runtime constructs the attacker-specified object and executes the embedded gadget logic. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-m8j2-5jr7-2jpw.

No public proof-of-concept exploit is listed in the advisory, and the issue is not present in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-25925

Indicators of Compromise

Flow or App package JSON files containing a $type property referencing types outside the expected Power Platform schema, especially System.*, Microsoft.* reflection types, or ObjectDataProvider variants.
PowerDocu process (PowerDocu.exe) spawning child processes such as cmd.exe, powershell.exe, or rundll32.exe.
Unexpected outbound network connections or file writes originating from the PowerDocu process directory.

Detection Strategies

Inspect Flow and App package contents before processing and flag JSON documents that include $type directives.
Build endpoint detection rules that alert on PowerDocu spawning interpreters or scripting hosts, which is not normal documentation behavior.
Correlate PowerDocu execution with file modifications in user profile directories and with new persistence entries created shortly after package ingestion.

Monitoring Recommendations

Log PowerDocu invocations and the file paths of packages it processes for retrospective review.
Monitor for installation of PowerDocu builds prior to 2.4.0 across managed endpoints using software inventory tooling.
Track distribution channels that deliver Flow and App exports and require provenance checks before users open shared packages.

How to Mitigate CVE-2026-25925

Immediate Actions Required

Upgrade all PowerDocu installations to version 2.4.0 or later using the PowerDocu 2.4.0 release.
Inventory endpoints that host PowerDocu and remove unauthorized or outdated copies.
Treat any Flow or App package received from outside the organization as untrusted until validated.

Patch Information

The maintainer released PowerDocu 2.4.0, which removes blind trust in the JSON $type property and prevents arbitrary .NET object instantiation during package parsing. Details are available in the GitHub Security Advisory GHSA-m8j2-5jr7-2jpw and the PowerDocu 2.4.0 release notes.

Workarounds

Restrict PowerDocu use to packages exported from trusted, internal Power Platform tenants until the upgrade is complete.
Run PowerDocu under a low-privilege user account without administrative rights to limit the blast radius of any successful exploitation.
Sanitize Flow and App package JSON to strip $type properties before processing if upgrading is not immediately possible.

bash

# Example: strip $type properties from JSON files in an extracted package
find ./extracted-package -name '*.json' -print0 | \
  xargs -0 -I{} sh -c 'jq "walk(if type == \"object\" then del(.[\"\$type\"]) else . end)" "{}" > "{}.clean" && mv "{}.clean" "{}"'