Argument Injection Vulnerability in CliInvoke .NET Library by Alastair Lundy
CVE-2026-100369

8.4HIGH

Key Information:

Vendor

Alastairlundy

Status
Cliinvoke
Alastairlundy.cliinvoke
Vendor
CVE Published:
25 September 2026

What is CVE-2026-100369?

The CliInvoke libraries, including versions from 2.0.0 to 2.8.4 and certain 3.x versions, exhibit an argument injection flaw within their process factory implementations. This vulnerability allows an adversary to manipulate command-line arguments through malicious inputs. It specifically leverages the improper handling of double quotes in the user-controlled target and arguments, leading to unexpected command execution. Users are advised to update to the patched versions to mitigate risks effectively. As a short-term workaround, removing double quotes and shell metacharacters in inputs may reduce exposure, while alternative methods such as constructing a custom ProcessConfiguration can bypass the vulnerable constructs.

Affected Version(s)

AlastairLundy.CliInvoke >= 2.0.0-alpha.1, <= 2.0.0

CliInvoke >= 2.0.0, <= 2.8.4 <= 2.0.0, 2.8.4

CliInvoke >= 2.9.0, <= 2.9.3 <= 2.9.0, 2.9.3

References

https://github.com/alastairlundy/CliInvoke/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.