Skip to content

SysManager 1.52.92

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Jul 21:34
· 713 commits to main since this release
v1.52.92
7c08564
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's new for you

A security hardening for the Bulk Installer: it now runs winget only from its trusted system location and cleans up the text you type in the search box before passing it along. This closes a gap where a malicious file placed next to the app could have run with your privileges, and prevents crafted search text from injecting extra commands. No change to how installing apps works for you.

[1.52.92] - 2026-07-11

Fixed

  • The Bulk Installer launched winget by bare name from a hand-built process with no pinned working directory, enabling binary-planting privilege escalation, and interpolated the raw search box text into the winget arguments (argument injection). MarkInstalledAppsAsync (runs automatically on tab open) and the package search both built their own ProcessStartInfo { FileName = "winget", UseShellExecute = false } with no WorkingDirectory. With UseShellExecute=false, Win32 CreateProcess searches the calling process's own directory before resolving the real winget App Execution Alias — so an attacker-planted winget.exe beside SysManager's portable .exe (often run from a user-writable folder, sometimes elevated) would run with the app's privileges. Separately, the search argument was built as $"search \"{query}\" …" from the unvalidated search box — the one process-launch trust boundary in the app without input validation — so a query containing a double-quote could break out and inject extra winget arguments. Both winget calls now route through BulkInstallerService (the IPowerShellRunner seam), which launches winget with WorkingDirectory pinned to System32 (removing the CWD from the search order, matching every other winget call in the app), and the search query is sanitized (double-quotes and control characters stripped) before interpolation. This also brings the two calls in line with the architecture rules — external process launches route through the single runner seam instead of a bespoke ProcessStartInfo.

Verify the download

Get-FileHash .\SysManager-v1.52.92.exe -Algorithm SHA256

Expected SHA256: EF9DD4C7B9FFD95DAE0FFA81A65690191DFC9EF1B7577423B987DB8E9C09D723

Assets 4
Loading