{"uuid": "766e24c1-39d3-434e-977a-ecc542d3ebae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100368", "type": "seen", "source": "https://gist.github.com/alon710/3bf978c1c1d2c0f47957618ee41a82fa", "content": "# CVE-2026-100368: CVE-2026-100368: OS Command Injection in CliInvoke Shell Wrappers\n\n> **CVSS Score:** 8.4\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-100368\n\n## Summary\nAn OS command injection vulnerability exists in the PowerShell and Cmd shell wrappers of the CliInvoke .NET library (specifically the CliInvoke.Specializations package). Under vulnerable configurations, arguments and targets are passed as a single flat string to ProcessStartInfo.Arguments, permitting double-quote breakout and execution of arbitrary secondary commands with host process privileges.\n\n## TL;DR\nFlaw in CliInvoke shell wrappers allows unauthenticated local attackers to execute arbitrary OS commands via crafted double-quote characters in target paths or execution arguments.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78\n- **Attack Vector**: Local\n- **CVSS Score**: 8.4\n- **EPSS Score**: N/A\n- **Impact**: High (Full Confidentiality, Integrity, and Availability Impact)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- CliInvoke.Specializations\n- AlastairLundy.CliInvoke.Specializations\n- .NET Core and .NET applications wrapping powershell or cmd execution via CliInvoke\n- **CliInvoke.Specializations**: >= 2.2.0, <= 2.8.4 (Fixed in: `2.8.5`)\n- **CliInvoke.Specializations**: >= 2.9.0, <= 2.9.3 (Fixed in: `2.9.4`)\n- **CliInvoke.Specializations**: >= 2.10.0, <= 2.10.4 (Fixed in: `2.10.5`)\n- **CliInvoke.Specializations**: 3.0.0-alpha.1 - 3.0.0-alpha.10 (Fixed in: `3.0.0-beta.1`)\n- **AlastairLundy.CliInvoke.Specializations**: >= 1.0.0-rc.1, <= 2.0.0 (Fixed in: `2.0.2`)\n\n## Mitigation\n\n- Upgrade CliInvoke.Specializations to safe versions (2.8.5, 2.9.4, 2.10.5, or 3.0.0-beta.1)\n- Strictly validate user-supplied parameters to reject double quotes (\")\n- Bypass shell wrappers entirely when executing processes using untrusted parameters\n\n**Remediation Steps:**\n1. Identify all projects using CliInvoke.Specializations or AlastairLundy.CliInvoke.Specializations\n2. Update NuGet dependencies to the appropriate patched release versions\n3. Audit validation libraries to block quotes (\") and shell operators (; | & $ ` ()) on legacy lines\n\n## References\n\n- [GitHub Security Advisory (Authoritative)](https://github.com/alastairlundy/CliInvoke/security/advisories/GHSA-wrvw-254r-wpmv)\n- [National Vulnerability Database (NVD) Record](https://nvd.nist.gov/vuln/detail/CVE-2026-100368)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-100368)\n- [GitHub Commit - Code Tokenization Implementation](https://github.com/alastairlundy/CliInvoke/commit/1e98582f02eb43e345e5b97b8dd6ff9443806685)\n- [GitHub Commit - Shell Middleware ArgumentList Integration](https://github.com/alastairlundy/CliInvoke/commit/2077e5239850e83dc9cc67ae6036dcd4e68a1876)\n- [CliInvoke Release v2.10.5 Tag](https://github.com/alastairlundy/CliInvoke/releases/tag/2.10.5)\n- [CliInvoke Release v3.0.0-beta.1 Tag](https://github.com/alastairlundy/CliInvoke/releases/tag/3.0.0-beta.1)\n- [CliInvoke Project Repository](https://github.com/alastairlundy/CliInvoke)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-100368) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-26T03:30:31.000000Z"}