OS Command Injection in CliInvoke Library from Alastair Lundy
CVE-2026-100368

8.4HIGH

Key Information:

Vendor

Alastairlundy

Status
Cliinvoke.specializations
Vendor
CVE Published:
25 September 2026

What is CVE-2026-100368?

The CliInvoke library, utilized for invoking command-line applications, contains an OS command injection vulnerability in its PowerShell and Cmd wrappers. This issue allows an attacker to exploit untrusted input by adding a double quote, which disrupts the proper quoting mechanisms and enables the execution of arbitrary commands with elevated privileges. The affected versions range from 2.2.0 to 2.10.4 and several alpha versions. Users are encouraged to upgrade to the patched versions or implement strict input validation to mitigate the risk.

Affected Version(s)

CliInvoke.Specializations >= 2.2.0, <= 2.8.4 <= 2.2.0, 2.8.4

CliInvoke.Specializations >= 2.9.0, <= 2.9.3 <= 2.9.0, 2.9.3

CliInvoke.Specializations >= 2.10.0, <= 2.10.4 <= 2.10.0, 2.10.4

References

https://github.com/alastairlundy/CliInvoke/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.