High-Severity OpenVPN Flaw (CVE-2025-10680) Allows Script Injection on Linux/macOS via Malicious DNS Server

Security researchers have disclosed a high-severity vulnerability in OpenVPN, tracked as CVE-2025-10680 (CVSS 8.8), affecting OpenVPN 2.7_alpha1 through 2.7_beta1 releases. The flaw exposes Unix-like systems to script injection when connecting to untrusted VPN servers, potentially enabling remote code execution on the client side.

According to the security announcement, the pushed –dns and –dhcp-option arguments are not properly sanitised when passing them to the –dns-updown script hook, allowing additional commands to be injected during the DNS update hook. The issue affects POSIX-based platforms such as Linux, BSD, and macOS, with Windows largely unaffected unless configured to use the built-in PowerShell call in the same script path.

The OpenVPN team released a patch in OpenVPN 2.7_beta2 that introduces proper input sanitation for DNS strings, and administrators are urged to upgrade to 2.7_beta2 or later. Production users on OpenVPN 2.6.x or stable releases are not affected.