AZDO.1025: Enable shell tasks arguments validation.
| ID | AZDO.1025 |
| Severity | High |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Pipelines |
| Security area | Engineering systems |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:SI-10 Information Input Validation |
| MITRE ATT&CK | T1059, T1677 |
| Reads from | Azure DevOps |
| Further reading | https://learn.microsoft.com/azure/devops/pipelines/security/inputs?view=azure-devops#shellTasksValidation |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Enable Shell Task Validation to prevent code injection.
Rationale: Code injection through arguments parameters should be prevented.
Remediation action
Section titled “Remediation action”Enable the policy to stop these requests and notifications.
- Sign in to your organization.
- Choose Organization settings.
- Select Settings under Pipelines.
- Go to the section “Task restrictions” and turn on “Enable shell tasks arguments validation”
Results: This validation applies to the arguments parameter in the following specific tasks:
- PowerShell
- BatchScript
- Bash
- Ssh
- AzureFileCopy
- WindowsMachineFileCopy
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.