Gert Doering reports:
Notable changes beta1 ->
beta2 are: [...] add proper input sanitation to DNS strings to
prevent an attack coming from a trusted-but-malicous OpenVPN server
(CVE: 2025-10680, affects unixoid systems with --dns-updown scripts
and windows using the built-in powershell call)
Lev Stipakov writes:
On Linux (and similar platforms), those options are written to a tmp
file, which is later sourced by a script running as root. Since
options are controlled by the server, it is possible for a malicious
server to execute script injection attack [...].
The original report is credited to Stanislav Fort <disclosure@aisle.com>.