cyfenced.com →

[ CVE-2026-100368 · Published 25 Sep 2026 ]

CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers

CVSS 8.4 EPSS <1%Fix available

[ Description ]Official description

CliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specializations` packages provide specialized wrappers for shells such as PowerShell and Windows Command Prompt. `CliInvoke.Specializations` versions 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, 3.0.0-alpha.1 through 3.0.0-alpha.4, and 3.0.0-alpha.8 through 3.0.0-alpha.10, as well as `AlastairLundy.CliInvoke.Specializations` versions 1.0.0-rc.1 through 1.6.1.1, contain an OS command injection vulnerability in their PowerShell and Cmd wrappers. The wrappers pass a caller-controlled target and arguments to `pwsh -Command` or `cmd /c` using a single `ProcessStartInfo.Arguments` string, allowing a double quote in untrusted input to break operating-system-level quoting and cause the shell to execute an additional command with the host process's privileges. The vulnerability is patched in `CliInvoke.Specializations` versions 2.8.5, 2.9.4, 2.10.5, and 3.0.0-beta.1, and in `AlastairLundy.CliInvoke.Specializations` version 2.0.2. No complete workaround is available; users unable to upgrade should reject or remove double quotes from target paths and arguments, additionally reject shell metacharacters in versions 2.2.0 through 2.9.2 and 3.0.0-alpha.1 through 3.0.0-alpha.4, or bypass the PowerShell and Cmd wrappers and invoke target processes directly when handling untrusted input.

[ Fixes ]Fixes and patches

  • CliInvoke.Specializations 2.8.5Fixed version · GitHub Advisories · nuget package CliInvoke.Specializations: upgrade to 2.8.5 or later (affected >= 2.2.0, <= 2.8.4)
  • CliInvoke.Specializations 2.9.4Fixed version · GitHub Advisories · nuget package CliInvoke.Specializations: upgrade to 2.9.4 or later (affected >= 2.9.0, <= 2.9.3)
  • CliInvoke.Specializations 2.10.5Fixed version · GitHub Advisories · nuget package CliInvoke.Specializations: upgrade to 2.10.5 or later (affected >= 2.10.0, <= 2.10.4)
  • CliInvoke.Specializations 3.0.0-beta.1Fixed version · GitHub Advisories · nuget package CliInvoke.Specializations: upgrade to 3.0.0-beta.1 or later (affected >= 3.0.0-alpha.1, <= 3.0.0-alpha.4)
  • AlastairLundy.CliInvoke.Specializations 2.0.2Fixed version · GitHub Advisories · nuget package AlastairLundy.CliInvoke.Specializations: upgrade to 2.0.2 or later (affected >= 1.0.0-rc.1, <= 1.6.1.1)

[ Packages ]Affected open-source packages

  • CliInvoke.Specializations nugetAffected >= 2.2.0, <= 2.8.4 · fixed in 2.8.5 · GHSA-wrvw-254r-wpmv
  • CliInvoke.Specializations nugetAffected >= 2.9.0, <= 2.9.3 · fixed in 2.9.4 · GHSA-wrvw-254r-wpmv
  • CliInvoke.Specializations nugetAffected >= 2.10.0, <= 2.10.4 · fixed in 2.10.5 · GHSA-wrvw-254r-wpmv
  • CliInvoke.Specializations nugetAffected >= 3.0.0-alpha.1, <= 3.0.0-alpha.4 · fixed in 3.0.0-beta.1 · GHSA-wrvw-254r-wpmv
  • CliInvoke.Specializations nugetAffected >= 3.0.0-alpha.8, <= 3.0.0-alpha.10 · fixed in 3.0.0-beta.1 · GHSA-wrvw-254r-wpmv
  • AlastairLundy.CliInvoke.Specializations nugetAffected >= 1.0.0-rc.1, <= 1.6.1.1 · fixed in 2.0.2 · GHSA-wrvw-254r-wpmv

[ References ]References