Shift Happens – Uncovering Two Built-in Command Injections in Windows Context Menus

**Executive summary:** This research identifies two command-injection vulnerabilities in Windows Explorer's "Open PowerShell window here" context menu—introduced in Windows 10 1703 and present in many Windows 11 builds—where improperly quoted %V template values allow attacker-controlled folder names to inject and execute arbitrary PowerShell commands when a user opens a shell via Shift+Right-Click; proof-of-concepts, exploitation scenarios, and responsible disclosure to MSRC (VULN-150675) are provided.