CliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappers
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
CliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specializations` packages provide specialized wrappers for shells such as PowerShell and Windows Command Prompt. `CliInvoke.Specializations` versions 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, 3.0.0-alpha.1 through 3.0.0-alpha.4, and 3.0.0-alpha.8 through 3.0.0-alpha.10, as well as `AlastairLundy.CliInvoke.Specializations` versions 1.0.0-rc.1 through 1.6.1.1, contain an OS command injection vulnerability in their PowerShell and Cmd wrappers. The wrappers pass a caller-controlled target and arguments to `pwsh -Command` or `cmd /c` using a single `ProcessStartInfo.Arguments` string, allowing a double quote in untrusted input to break operating-system-level quoting and cause the shell to execute an additional command with the host process's privileges. The vulnerability is patched in `CliInvoke.Specializations` versions 2.8.5, 2.9.4, 2.10.5, and 3.0.0-beta.1, and in `AlastairLundy.CliInvoke.Specializations` version 2.0.2. No complete workaround is available; users unable to upgrade should reject or remove double quotes from target paths and arguments, additionally reject shell metacharacters in versions 2.2.0 through 2.9.2 and 3.0.0-alpha.1 through 3.0.0-alpha.4, or bypass the PowerShell and Cmd wrappers and invoke target processes directly when handling untrusted input.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| alastairlundy | CliInvoke.Specializations | 2.2.0 – 2.8.4; 2.9.0 – 2.9.3; 2.10.0 – 2.10.4; 3.0.0-alpha.1 – 3.0.0-alpha.4; 3.0.0-alpha.8 – 3.0.0-alpha.10; 1.0.0-rc.1 – 1.6.1.1 | — | No fix listed | CNA |
| — | CliInvoke.Specializations (NuGet) | 2.2.0 to before 2.8.5 | 2.8.5 | Patch available | GHSA-wrvw-254r-wpmv |
| — | CliInvoke.Specializations (NuGet) | 2.9.0 to before 2.9.4 | 2.9.4 | Patch available | GHSA-wrvw-254r-wpmv |
| — | CliInvoke.Specializations (NuGet) | 2.10.0 to before 2.10.5 | 2.10.5 | Patch available | GHSA-wrvw-254r-wpmv |
| — | CliInvoke.Specializations (NuGet) | 3.0.0-alpha.1 to before 3.0.0-beta.1 | 3.0.0-beta.1 | Patch available | GHSA-wrvw-254r-wpmv |
| — | CliInvoke.Specializations (NuGet) | 3.0.0-alpha.8 to before 3.0.0-beta.1 | 3.0.0-beta.1 | Patch available | GHSA-wrvw-254r-wpmv |
| — | AlastairLundy.CliInvoke.Specializations (NuGet) | 1.0.0-rc.1 to before 2.0.2 | 2.0.2 | Patch available | GHSA-wrvw-254r-wpmv |
- CliInvoke.Specializations Vendoralastairlundy Affected 2.2.0 – 2.8.4; 2.9.0 – 2.9.3; 2.10.0 – 2.10.4; 3.0.0-alpha.1 – 3.0.0-alpha.4; 3.0.0-alpha.8 – 3.0.0-alpha.10; 1.0.0-rc.1 – 1.6.1.1 Fixed in — No fix listed CNA
- CliInvoke.Specializations (NuGet) Vendor— Affected 2.2.0 to before 2.8.5 Fixed in 2.8.5 Patch available GHSA-wrvw-254r-wpmv
- CliInvoke.Specializations (NuGet) Vendor— Affected 2.9.0 to before 2.9.4 Fixed in 2.9.4 Patch available GHSA-wrvw-254r-wpmv
- CliInvoke.Specializations (NuGet) Vendor— Affected 2.10.0 to before 2.10.5 Fixed in 2.10.5 Patch available GHSA-wrvw-254r-wpmv
- CliInvoke.Specializations (NuGet) Vendor— Affected 3.0.0-alpha.1 to before 3.0.0-beta.1 Fixed in 3.0.0-beta.1 Patch available GHSA-wrvw-254r-wpmv
- CliInvoke.Specializations (NuGet) Vendor— Affected 3.0.0-alpha.8 to before 3.0.0-beta.1 Fixed in 3.0.0-beta.1 Patch available GHSA-wrvw-254r-wpmv
- AlastairLundy.CliInvoke.Specializations (NuGet) Vendor— Affected 1.0.0-rc.1 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-wrvw-254r-wpmv
Remediation
- Fix · GHSA-wrvw-254r-wpmv CliInvoke.Specializations (NuGet) Fixed in 2.8.5 Advisory →
- Fix · GHSA-wrvw-254r-wpmv CliInvoke.Specializations (NuGet) Fixed in 2.9.4 Advisory →
- Fix · GHSA-wrvw-254r-wpmv CliInvoke.Specializations (NuGet) Fixed in 2.10.5 Advisory →
- Fix · GHSA-wrvw-254r-wpmv CliInvoke.Specializations (NuGet) Fixed in 3.0.0-beta.1 Advisory →
- Fix · GHSA-wrvw-254r-wpmv CliInvoke.Specializations (NuGet) Fixed in 3.0.0-beta.1 Advisory →
- Fix · GHSA-wrvw-254r-wpmv AlastairLundy.CliInvoke.Specializations (NuGet) Fixed in 2.0.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-100368
- 2026-10-03 Alias added: GHSA-wrvw-254r-wpmv
References
Other 6
- https://github.com/alastairlundy/CliInvoke/security/advisories/GHSA-wrvw-254r-wpmv
- https://github.com/alastairlundy/CliInvoke/commit/1e98582f02eb43e345e5b97b8dd6ff9443806685
- https://github.com/alastairlundy/CliInvoke/commit/2077e5239850e83dc9cc67ae6036dcd4e68a1876
- https://github.com/alastairlundy/CliInvoke
- https://github.com/alastairlundy/CliInvoke/releases/tag/2.10.5
- https://github.com/alastairlundy/CliInvoke/releases/tag/3.0.0-beta.1
More alastairlundy vulnerabilities
- TI-2026-64647 CliInvoke: Argument Injection in Extensibility Runner Factory CVSS 3.1HIGH 8.4
Sources
- CVE-2026-100368 · CVE Program
- CVE-2026-100368 · NVD
- FIRST EPSS
- GHSA-wrvw-254r-wpmv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences