Skip to content

AvoidUsingInvokeExpression.md

Latest commit

 

History

History
48 lines (34 loc) · 1.3 KB

AvoidUsingInvokeExpression.md

File metadata and controls

48 lines (34 loc) · 1.3 KB
Raw
description Avoid using Invoke-Expression
ms.date 07/21/2026
ms.topic reference
title AvoidUsingInvokeExpression

AvoidUsingInvokeExpression

Severity Level: Warning

Default state: Always enabled

Description

This rule detects the use of the Invoke-Expression command, which poses security risks in your scripts and applications. You must be careful when using the Invoke-Expression command. It executes the specified string and returns the results.

Code injection vulnerabilities can occur if the expression passed as a string includes user-provided data, making your application susceptible to malicious attacks. Avoid using Invoke-Expression whenever possible.

Example

Noncompliant

Invoke-Expression 'Get-Process'

Compliant

Get-Process

Configure rule

This rule is always enabled and isn't configurable. Use one of the following methods to avoid using this rule:

  • Create a custom rule configuration file to include only the rules you want or exclude the rules you don't want.
  • Add the appropriate rule suppression attributes to your code to suppress the rule for specific code blocks. For more information, see the Suppressing rules section of Using PSScriptAnalyzer.