CVE-2026-100369: CliInvoke: Argument Injection in Extensibility Runner Factory
Impact An argument-injection vulnerability exists in the CliInvoke package's runner factory: RunnerProcessFactory on the 2.x line and RunnerConfigurationFactory on the 3.x line.
The factory joins the runner arguments, the caller's target, and the caller's arguments into a single ProcessStartInfo.Arguments string and hands it to the OS. The OS command-line parser re-tokenizes the string before the runner sees it. A double quote (") in the target or in any argument closes the OS-level quoted region and lets the next character enter argv as a separate element.
Patches Upgrade to:
- 2.8.5 (2.8.x line) - 2.9.4 (2.9.x line) - 2.10.5 (2.10.x line) - 3.0.0-beta.2 (3.x pre-release line)
Workarounds No complete workaround is available. Until you can upgrade:
- Strip " from any target or argument before passing it to the factory. On shell runners, also strip ;, |, &, $, backtick, and parentheses. - Or bypass the factory entirely and build the ProcessConfiguration directly. Set ArgumentList explicitly to the argv you want the runner to receive.
These are partial mitigations. They shift the quoting problem to your code.
Other sources
CliInvoke and its formerly named AlastairLundy.CliInvoke package are .NET libraries for invoking command-line programs and wrapping executable processes. CliInvoke versions 2.0.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, and 3.0.0-alpha.1 through 3.0.0-beta.1, as well as AlastairLundy.CliInvoke versions 2.0.0-alpha.1 through 2.0.0, contain an argument-injection vulnerability in RunnerProcessFactory on the 2.x line and RunnerConfigurationFactory on the 3.x line. These factories combine runner arguments, a caller-controlled target, and caller-controlled arguments into one ProcessStartInfo.Arguments string, allowing a double quote in the target or an argument to terminate an operating-system-level quoted region and inject unintended elements into the runner’s argument vector, potentially resulting in arbitrary command execution when a shell runner is used. The vulnerability is patched in CliInvoke versions 2.8.5, 2.9.4, 2.10.5, and 3.0.0-beta.2, and in AlastairLundy.CliInvoke version 2.0.2. No complete workaround is available; users unable to upgrade can partially mitigate the issue by removing double quotes from targets and arguments, additionally removing shell metacharacters when using shell runners, or bypassing the vulnerable factory and constructing a ProcessConfiguration with an explicit ArgumentList.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/AlastairLundy.CliInvoketo a version that resolves this vulnerability.Fixed in 2.0.2 - Upgrade
Upgrade
nuget/CliInvoketo a version that resolves this vulnerability.Fixed in 3.0.0-beta.2 - Upgrade
Upgrade
nuget/CliInvoketo a version that resolves this vulnerability.Fixed in 2.10.5 - Upgrade
Upgrade
nuget/CliInvoketo a version that resolves this vulnerability.Fixed in 2.9.4 - Upgrade
Upgrade
nuget/CliInvoketo a version that resolves this vulnerability.Fixed in 2.8.5 - Upgrade
Upgrade
CliInvoketo a version that resolves this vulnerability.Fixed in 2.8.5 - Upgrade
Upgrade
CliInvoketo a version that resolves this vulnerability.Fixed in 2.9.4 - Upgrade
Upgrade
CliInvoketo a version that resolves this vulnerability.Fixed in 2.10.5 - Upgrade
Upgrade
CliInvoketo a version that resolves this vulnerability.Fixed in 3.0.0-beta.2 - Upgrade
Upgrade
AlastairLundy.CliInvoketo a version that resolves this vulnerability.Fixed in 2.0.2 - Compensating control
Bypass the vulnerable runner factory and construct a ProcessConfiguration with an explicit ArgumentList containing the intended argv as separate elements.
- Compensating control
Before passing targets or arguments to the package's runner factory, strip double quotes; when using shell runners, also strip semicolons, pipes, ampersands, dollar signs, backticks, and parentheses.
Event History
Frequently Asked Questions
Which applications are most exposed to exploitation?
Applications are exposed when they use the affected runner factories and allow an attacker to influence the target or arguments passed to them. The impact can reach arbitrary command execution when the application uses a shell runner.
What input is required to exploit the issue?
An attacker needs control over a target or argument value that reaches the affected factory and contains a double quote. The quote can terminate an operating-system-level quoted region and add unintended entries to the runner's argument vector.
Are all affected package versions vulnerable?
The affected ranges are CliInvoke 2.0.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, and 3.0.0-alpha.1 through 3.0.0-beta.1. AlastairLundy.CliInvoke is affected from 2.0.0-alpha.1 through 2.0.0.
What should be done if an immediate upgrade is not possible?
No complete workaround is available. As a partial mitigation, remove double quotes from targets and arguments before they are passed to the affected factories.
Which releases contain the fix?
CliInvoke is patched in versions 2.8.5, 2.9.4, 2.10.5, and 3.0.0-beta.2. AlastairLundy.CliInvoke is patched in version 2.0.2.