{"vulnerability": "CVE-2026-100368", "sightings": [{"uuid": "f20f9cf3-89cd-4f99-9711-16f75ac4f961", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100368", "type": "seen", "source": "https://gist.github.com/ichintu/6ea92f5d3523919a824d2395951afa6c", "content": "This daily cyber threat intelligence digest highlights three critical software vulnerabilities, a major legal sentencing, and one non-security community post. Key takeaways:\n\n\u2022 **MediaWiki (CVE-2026-100382):** Critical (CVSS 10.0) unauthenticated RCE via OS command injection in the ExternalData extension (v<3.7).  \n\u2022 **WordPress (AV26-952):** Critical path traversal in page-template resolution enabling conditional RCE in versions <7.1.2. The flaw is actively exploited in the wild and has been added to CISA\u2019s KEV database; immediate patching is required.  \n\u2022 **CliInvoke.Specializations (CVE-2026-100368):** High (CVSS 8.4) command injection in PowerShell/Cmd wrappers caused by improper handling of untrusted arguments containing double quotes. Patched versions and mitigation workarounds are available.  \n\u2022 **Legal/Incident:** A U.S. Army soldier received a 70-month prison sentence and ~$300K in restitution for hacking AT&T and Verizon to steal mobile metadata, impacting over 100 million customers.  \n\u2022 **Non-Technical:** The digest also includes a community event recommendation for a family squid dissection in Tennessee.  \n\n**Overall:** Organizations should prioritize patching MediaWiki, WordPress, and CliInvoke components, while the sentencing underscores ongoing insider threats targeting critical telecom infrastructure.", "creation_timestamp": "2026-09-26T00:00:32.000000Z"}, {"uuid": "44714c21-1fb6-45f7-bf32-1e3030edb500", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100368", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfd5hhuco2m", "content": "\ud83d\udfe0 CVE-2026-100368 - High (8.4)\n\nCliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specialization...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100368/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T03:17:47.647780Z"}, {"uuid": "766e24c1-39d3-434e-977a-ecc542d3ebae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100368", "type": "seen", "source": "https://gist.github.com/alon710/3bf978c1c1d2c0f47957618ee41a82fa", "content": "# CVE-2026-100368: CVE-2026-100368: OS Command Injection in CliInvoke Shell Wrappers\n\n> **CVSS Score:** 8.4\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-100368\n\n## Summary\nAn OS command injection vulnerability exists in the PowerShell and Cmd shell wrappers of the CliInvoke .NET library (specifically the CliInvoke.Specializations package). Under vulnerable configurations, arguments and targets are passed as a single flat string to ProcessStartInfo.Arguments, permitting double-quote breakout and execution of arbitrary secondary commands with host process privileges.\n\n## TL;DR\nFlaw in CliInvoke shell wrappers allows unauthenticated local attackers to execute arbitrary OS commands via crafted double-quote characters in target paths or execution arguments.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78\n- **Attack Vector**: Local\n- **CVSS Score**: 8.4\n- **EPSS Score**: N/A\n- **Impact**: High (Full Confidentiality, Integrity, and Availability Impact)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- CliInvoke.Specializations\n- AlastairLundy.CliInvoke.Specializations\n- .NET Core and .NET applications wrapping powershell or cmd execution via CliInvoke\n- **CliInvoke.Specializations**: >= 2.2.0, <= 2.8.4 (Fixed in: `2.8.5`)\n- **CliInvoke.Specializations**: >= 2.9.0, <= 2.9.3 (Fixed in: `2.9.4`)\n- **CliInvoke.Specializations**: >= 2.10.0, <= 2.10.4 (Fixed in: `2.10.5`)\n- **CliInvoke.Specializations**: 3.0.0-alpha.1 - 3.0.0-alpha.10 (Fixed in: `3.0.0-beta.1`)\n- **AlastairLundy.CliInvoke.Specializations**: >= 1.0.0-rc.1, <= 2.0.0 (Fixed in: `2.0.2`)\n\n## Mitigation\n\n- Upgrade CliInvoke.Specializations to safe versions (2.8.5, 2.9.4, 2.10.5, or 3.0.0-beta.1)\n- Strictly validate user-supplied parameters to reject double quotes (\")\n- Bypass shell wrappers entirely when executing processes using untrusted parameters\n\n**Remediation Steps:**\n1. Identify all projects using CliInvoke.Specializations or AlastairLundy.CliInvoke.Specializations\n2. Update NuGet dependencies to the appropriate patched release versions\n3. Audit validation libraries to block quotes (\") and shell operators (; | & $ ` ()) on legacy lines\n\n## References\n\n- [GitHub Security Advisory (Authoritative)](https://github.com/alastairlundy/CliInvoke/security/advisories/GHSA-wrvw-254r-wpmv)\n- [National Vulnerability Database (NVD) Record](https://nvd.nist.gov/vuln/detail/CVE-2026-100368)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-100368)\n- [GitHub Commit - Code Tokenization Implementation](https://github.com/alastairlundy/CliInvoke/commit/1e98582f02eb43e345e5b97b8dd6ff9443806685)\n- [GitHub Commit - Shell Middleware ArgumentList Integration](https://github.com/alastairlundy/CliInvoke/commit/2077e5239850e83dc9cc67ae6036dcd4e68a1876)\n- [CliInvoke Release v2.10.5 Tag](https://github.com/alastairlundy/CliInvoke/releases/tag/2.10.5)\n- [CliInvoke Release v3.0.0-beta.1 Tag](https://github.com/alastairlundy/CliInvoke/releases/tag/3.0.0-beta.1)\n- [CliInvoke Project Repository](https://github.com/alastairlundy/CliInvoke)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-100368) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-26T03:30:31.000000Z"}]}