CVE-2026-100368

Received Received - Intake

OS Command Injection in CliInvoke Specializations

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

CliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specializations` packages provide specialized wrappers for shells such as PowerShell and Windows Command Prompt. `CliInvoke.Specializations` versions 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, 3.0.0-alpha.1 through 3.0.0-alpha.4, and 3.0.0-alpha.8 through 3.0.0-alpha.10, as well as `AlastairLundy.CliInvoke.Specializations` versions 1.0.0-rc.1 through 1.6.1.1, contain an OS command injection vulnerability in their PowerShell and Cmd wrappers. The wrappers pass a caller-controlled target and arguments to `pwsh -Command` or `cmd /c` using a single `ProcessStartInfo.Arguments` string, allowing a double quote in untrusted input to break operating-system-level quoting and cause the shell to execute an additional command with the host process's privileges. The vulnerability is patched in `CliInvoke.Specializations` versions 2.8.5, 2.9.4, 2.10.5, and 3.0.0-beta.1, and in `AlastairLundy.CliInvoke.Specializations` version 2.0.2. No complete workaround is available; users unable to upgrade should reject or remove double quotes from target paths and arguments, additionally reject shell metacharacters in versions 2.2.0 through 2.9.2 and 3.0.0-alpha.1 through 3.0.0-alpha.4, or bypass the PowerShell and Cmd wrappers and invoke target processes directly when handling untrusted input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-100368

Affected Vendors & Products

Vendor	Product	Version / Range
alastairlundy	cliinvoke.specializations	From 1.0.0-rc.1 (inc) to 1.6.1.1 (inc)
alastairlundy	cliinvoke.specializations	From 2.2.0 (inc) to 2.9.3 (exc)
alastairlundy	cliinvoke.specializations	From 2.10.0 (inc) to 2.10.5 (exc)
alastairlundy	cliinvoke.specializations	From 3.0.0-alpha.1 (inc) to 3.0.0-alpha.5 (exc)
alastairlundy	cliinvoke.specializations	From 3.0.0-alpha.8 (inc) to 3.0.0-alpha.11 (exc)
alastairlundy	cliinvoke.specializations	2.8.5
alastairlundy	cliinvoke.specializations	2.9.4
alastairlundy	cliinvoke.specializations	2.10.5
alastairlundy	cliinvoke.specializations	3.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CliInvoke.Specializations is a .NET library for wrapping command-line shells like PowerShell and Windows Command Prompt. Versions between 2.2.0 and 2.10.4, 3.0.0-alpha.1 to alpha.4 and alpha.8 to alpha.10, and AlastairLundy.CliInvoke.Specializations 1.0.0-rc.1 to 1.6.1.1 contain an OS command injection flaw. The wrappers improperly handle user-controlled input passed to pwsh -Command or cmd /c, allowing double quotes in input to break shell quoting and execute additional commands with the host process's privileges.

The issue arises because the library concatenates target and arguments into a single ProcessStartInfo.Arguments string without proper escaping. This enables attackers to inject extra commands by including double quotes in untrusted input.

Detection Guidance

Check installed versions of CliInvoke.Specializations or AlastairLundy.CliInvoke.Specializations. Vulnerable versions are 2.2.0-2.8.4, 2.9.0-2.9.3, 2.10.0-2.10.4, 3.0.0-alpha.1-3.0.0-alpha.4, 3.0.0-alpha.8-3.0.0-alpha.10, and 1.0.0-rc.1-1.6.1.1.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on your system with the same privileges as the application using the vulnerable library. If your application processes untrusted input through these wrappers, an attacker could take control of your system, steal data, install malware, or perform other malicious actions.

The impact is severe because the injected commands run with the host process's privileges, which could be high depending on the application context. Successful exploitation does not require user interaction beyond providing crafted input to the vulnerable application.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements and HIPAA's security and privacy rules. Organizations using affected versions may face compliance violations, regulatory fines, and reputational damage if exploited.

The ability to execute arbitrary commands with elevated privileges could result in data breaches, unauthorized data access, or system modifications, all of which are critical compliance concerns under GDPR and HIPAA.

Mitigation Strategies

Upgrade to patched versions: CliInvoke.Specializations 2.8.5, 2.9.4, 2.10.5, 3.0.0-beta.1 or AlastairLundy.CliInvoke.Specializations 2.0.2.
If unable to upgrade, sanitize inputs by rejecting double quotes and shell metacharacters in affected versions.
For versions 2.2.0-2.9.2 and 3.0.0-alpha.1-3.0.0-alpha.4, bypass PowerShell and Cmd wrappers when handling untrusted input.

Hi! I’m here to help you understand CVE-2026-100368. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70