DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-100369: CVE-2026-100369: Argument Injection Vulnerability in CliInvoke Process Runner Factories

#security #cve #cybersecurity

CVE-2026-100369: Argument Injection Vulnerability in CliInvoke Process Runner Factories

Vulnerability ID: CVE-2026-100369
CVSS Score: 8.4
Published: 2026-09-25

An argument injection vulnerability (CWE-88) in CliInvoke and AlastairLundy.CliInvoke allows local attackers to execute arbitrary system commands. By injecting double-quote characters into target file paths or arguments, attackers can terminate operating-system-level quoted boundaries and introduce new commands when shell runners are utilized.

TL;DR

CliInvoke process runner factories are vulnerable to argument injection via double-quote manipulation. This allows local attackers to execute arbitrary system commands when wrapper shell runners are used. Fixes are available in versions 2.8.5, 2.9.4, 2.10.5, and 3.0.0-beta.2.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-88
  • Attack Vector: Local (AV:L)
  • CVSS Base Score: 8.4 (High)
  • EPSS Score: N/A
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • CliInvoke (NuGet Package)
  • AlastairLundy.CliInvoke (Legacy NuGet Package)
  • CliInvoke: >= 2.0.0, <= 2.8.4 (Fixed in: 2.8.5)
  • CliInvoke: >= 2.9.0, <= 2.9.3 (Fixed in: 2.9.4)
  • CliInvoke: >= 2.10.0, <= 2.10.4 (Fixed in: 2.10.5)
  • CliInvoke: >= 3.0.0-alpha.1, <= 3.0.0-beta.1 (Fixed in: 3.0.0-beta.2)
  • AlastairLundy.CliInvoke: >= 2.0.0-alpha.1, <= 2.0.0 (Fixed in: 2.0.2)

Mitigation Strategies

  • Upgrade the package to the latest patched version
  • Ensure target execution uses .NET 8.0 or greater for active ArgumentList populating
  • Implement double-quote filtering on all user-supplied paths and arguments

Remediation Steps:

  1. Identify all direct or transitive dependencies on CliInvoke or AlastairLundy.CliInvoke.
  2. Update project files to reference NuGet package CliInvoke >= 2.8.5, 2.9.4, 2.10.5, or 3.0.0-beta.2, or legacy package AlastairLundy.CliInvoke >= 2.0.2.
  3. Recompile and deploy updated binaries targeting .NET 8.0 or higher.
  4. Confirm that runner invocations parse arguments into discrete collections where possible.

References

Read the full report for CVE-2026-100369 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)