CVE-2026-100369 in CliInvoke
Summary
by MITRE • 09/25/2026
CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libraries for invoking command-line programs and wrapping executable processes. `CliInvoke` versions 2.0.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, and 3.0.0-alpha.1 through 3.0.0-beta.1, as well as `AlastairLundy.CliInvoke` versions 2.0.0-alpha.1 through 2.0.0, contain an argument-injection vulnerability in `RunnerProcessFactory` on the 2.x line and `RunnerConfigurationFactory` on the 3.x line. These factories combine runner arguments, a caller-controlled target, and caller-controlled arguments into one `ProcessStartInfo.Arguments` string, allowing a double quote in the target or an argument to terminate an operating-system-level quoted region and inject unintended elements into the runner’s argument vector, potentially resulting in arbitrary command execution when a shell runner is used. The vulnerability is patched in `CliInvoke` versions 2.8.5, 2.9.4, 2.10.5, and 3.0.0-beta.2, and in `AlastairLundy.CliInvoke` version 2.0.2. No complete workaround is available; users unable to upgrade can partially mitigate the issue by removing double quotes from targets and arguments, additionally removing shell metacharacters when using shell runners, or bypassing the vulnerable factory and constructing a `ProcessConfiguration` with an explicit `ArgumentList`.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in CliInvoke, formerly known as AlastairLundy.CliInvoke, represents a critical argument injection flaw within .NET libraries designed for invoking command-line programs. This issue affects multiple versions across the 2.x and 3.x release lines, specifically including versions 2.0.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, and pre-release versions up to 3.0.0-beta.1 for CliInvoke, as well as AlastairLundy.CliInvoke versions from 2.0.0-alpha.1 through 2.0.0. The core of the vulnerability lies in how these libraries handle process configuration by combining runner arguments, a caller-controlled target executable path, and caller-provided arguments into a single string assigned to ProcessStartInfo.Arguments. This architectural decision creates a significant security gap because it relies on shell-level parsing rather than direct argument passing when using certain runners, thereby exposing the application to command injection attacks if input is not strictly sanitized.
The technical mechanism of this flaw involves improper neutralization of special elements used in commands and arguments, commonly categorized under CWE-88: Argument Injection or CWE-77: Command Injection depending on the specific execution context. When a shell runner is utilized, the library constructs a command line string that includes double quotes around paths and arguments to handle spaces correctly. However, if an attacker can control either the target executable path or any of the provided arguments, they can inject a closing double quote character. This injected quote terminates the intended quoted region within the constructed argument string. Once this quoting boundary is broken, subsequent characters are interpreted by the operating system shell as new command-line tokens rather than part of the original parameter list. Consequently, an attacker can append arbitrary commands to be executed alongside or instead of the intended process invocation.
The operational impact of this vulnerability is severe, potentially leading to remote code execution if the affected library is used in a context where untrusted input influences the target path or arguments. For instance, if a web application allows users to specify which tool to run and what parameters to pass, an attacker could craft inputs that escape the intended command scope and execute system-level commands with the privileges of the running process. This aligns with ATT&CK technique T1059: Command and Scripting Interpreter, specifically sub-techniques involving shell injection or argument manipulation. The risk is exacerbated in environments where the application runs with elevated permissions, as successful exploitation would grant the attacker full control over the underlying operating system environment managed by that process.
Mitigation strategies focus primarily on upgrading to patched versions of the library. For CliInvoke, this includes version 2.8.5 and later for the 2.x line, version 2.9.4 and later for the 2.9 series, version 2.10.5 and later for the 2.10 series, and version 3.0.0-beta.2 or later for the 3.x alpha/beta releases. For users of AlastairLundy.CliInvoke, upgrading to version 2.0.2 resolves the issue. In scenarios where immediate upgrade is not feasible due to dependency constraints or testing requirements, partial mitigations can be implemented by developers. These include strictly removing double quotes from any user-controlled target paths and arguments before passing them to the library. Furthermore, when shell runners are unavoidable, it is critical to strip all shell metacharacters such as semicolons, pipes, ampersands, and backticks from inputs. A more robust workaround involves bypassing the vulnerable factory methods entirely by constructing a ProcessConfiguration object directly with an explicit ArgumentList property, which ensures arguments are passed individually rather than concatenated into a single string susceptible to injection.