https://vulnerability.circl.lu/sightings/feed 2026-09-28T11:54:43.603586+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/46b0a269-6fa9-4634-968a-f54d8ca211cc/export 2026-09-28T11:54:43.634862+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "46b0a269-6fa9-4634-968a-f54d8ca211cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100369", "type": "seen", "source": "https://gist.github.com/alon710/2d1e9d9adea50782a3aa28ba496e0855", "content": "# CVE-2026-100369: CVE-2026-100369: Argument Injection Vulnerability in CliInvoke Process Runner Factories\n\n> **CVSS Score:** 8.4\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-100369\n\n## Summary\nAn argument injection vulnerability (CWE-88) in CliInvoke and AlastairLundy.CliInvoke allows local attackers to execute arbitrary system commands. By injecting double-quote characters into target file paths or arguments, attackers can terminate operating-system-level quoted boundaries and introduce new commands when shell runners are utilized.\n\n## TL;DR\nCliInvoke process runner factories are vulnerable to argument injection via double-quote manipulation. This allows local attackers to execute arbitrary system commands when wrapper shell runners are used. Fixes are available in versions 2.8.5, 2.9.4, 2.10.5, and 3.0.0-beta.2.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-88\n- **Attack Vector**: Local (AV:L)\n- **CVSS Base Score**: 8.4 (High)\n- **EPSS Score**: N/A\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- CliInvoke (NuGet Package)\n- AlastairLundy.CliInvoke (Legacy NuGet Package)\n- **CliInvoke**: >= 2.0.0, <= 2.8.4 (Fixed in: `2.8.5`)\n- **CliInvoke**: >= 2.9.0, <= 2.9.3 (Fixed in: `2.9.4`)\n- **CliInvoke**: >= 2.10.0, <= 2.10.4 (Fixed in: `2.10.5`)\n- **CliInvoke**: >= 3.0.0-alpha.1, <= 3.0.0-beta.1 (Fixed in: `3.0.0-beta.2`)\n- **AlastairLundy.CliInvoke**: >= 2.0.0-alpha.1, <= 2.0.0 (Fixed in: `2.0.2`)\n\n## Mitigation\n\n- Upgrade the package to the latest patched version\n- Ensure target execution uses .NET 8.0 or greater for active ArgumentList populating\n- Implement double-quote filtering on all user-supplied paths and arguments\n\n**Remediation Steps:**\n1. Identify all direct or transitive dependencies on CliInvoke or AlastairLundy.CliInvoke.\n2. Update project files to reference NuGet package CliInvoke >= 2.8.5, 2.9.4, 2.10.5, or 3.0.0-beta.2, or legacy package AlastairLundy.CliInvoke >= 2.0.2.\n3. Recompile and deploy updated binaries targeting .NET 8.0 or higher.\n4. Confirm that runner invocations parse arguments into discrete collections where possible.\n\n## References\n\n- [GitHub Security Advisory GHSA-j73w-8hfr-4gc9](https://github.com/alastairlundy/CliInvoke/security/advisories/GHSA-j73w-8hfr-4gc9)\n- [CVE-2026-100369 on CVE Registry](https://www.cve.org/CVERecord?id=CVE-2026-100369)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-100369) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-26T04:30:32.000000Z"} 2026-09-26T04:30:32+00:00 https://vulnerability.circl.lu/sighting/fdc4c6e9-7947-42d9-8d7d-d7edd053c62b/export 2026-09-28T11:54:43.636147+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "fdc4c6e9-7947-42d9-8d7d-d7edd053c62b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100369", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfd4z4myy2c", "content": "\ud83d\udfe0 CVE-2026-100369 - High (8.4)\n\nCliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libraries for invokin...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100369/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T03:17:32.561721Z"} 2026-09-26T03:17:32.561721+00:00 https://vulnerability.circl.lu/sighting/a15a3bee-6bb2-4bdb-96c5-b2775de82b0a/export 2026-09-28T11:54:43.636246+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a15a3bee-6bb2-4bdb-96c5-b2775de82b0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100369", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/gawoxc43gzebm", "content": "CVE-2026-100369 - CliInvoke: Argument Injection in Extensibility Runner Factory\nCVE ID : CVE-2026-100369\n \n Published : Sept. 25, 2026, 9:17 p.m. | 30\u00a0minutes ago\n \n Description : CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libraries for invokin...", "creation_timestamp": "2026-09-25T22:07:06.457946Z"} 2026-09-25T22:07:06.457946+00:00