GHSA-J73W-8HFR-4GC9

Vulnerability from github – Published: 2026-09-25 21:41 – Updated: 2026-09-25 21:41
VLAI
Summary
CliInvoke: Argument Injection in Extensibility Runner Factory
Details

Impact

An argument-injection vulnerability exists in the CliInvoke package's runner factory: RunnerProcessFactory on the 2.x line and RunnerConfigurationFactory on the 3.x line.

The factory joins the runner arguments, the caller's target, and the caller's arguments into a single ProcessStartInfo.Arguments string and hands it to the OS. The OS command-line parser re-tokenizes the string before the runner sees it. A double quote (") in the target or in any argument closes the OS-level quoted region and lets the next character enter argv as a separate element.

Patches

Upgrade to:

  • 2.8.5 (2.8.x line)
  • 2.9.4 (2.9.x line)
  • 2.10.5 (2.10.x line)
  • 3.0.0-beta.2 (3.x pre-release line)

Workarounds

No complete workaround is available. Until you can upgrade:

  • Strip " from any target or argument before passing it to the factory. On shell runners, also strip ;, |, &, $, backtick, and parentheses.
  • Or bypass the factory entirely and build the ProcessConfiguration directly. Set ArgumentList explicitly to the argv you want the runner to receive.

These are partial mitigations. They shift the quoting problem to your code.

Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.8.4"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "CliInvoke"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.8.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.9.3"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "CliInvoke"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.9.0"
            },
            {
              "fixed": "2.9.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.10.4"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "CliInvoke"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.10.0"
            },
            {
              "fixed": "2.10.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.0.0-beta.1"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "CliInvoke"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0-alpha.1"
            },
            {
              "fixed": "3.0.0-beta.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.0"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "AlastairLundy.CliInvoke"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-alpha.1"
            },
            {
              "fixed": "2.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-100369"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-25T21:41:36Z",
    "nvd_published_at": "2026-09-25T21:17:21Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nAn argument-injection vulnerability exists in the `CliInvoke`\npackage\u0027s runner factory: `RunnerProcessFactory` on the 2.x line and\n`RunnerConfigurationFactory` on the 3.x line.\n\nThe factory joins the runner arguments, the caller\u0027s target, and the\ncaller\u0027s arguments into a single `ProcessStartInfo.Arguments` string and\nhands it to the OS. The OS command-line parser re-tokenizes the string\nbefore the runner sees it. A double quote (`\"`) in the target or in any\nargument closes the OS-level quoted region and lets the next character\nenter argv as a separate element.\n\n### Patches\nUpgrade to:\n\n- **2.8.5** (2.8.x line)\n- **2.9.4** (2.9.x line)\n- **2.10.5** (2.10.x line)\n- **3.0.0-beta.2** (3.x pre-release line)\n\n### Workarounds\nNo complete workaround is available. Until you can upgrade:\n\n- Strip `\"` from any target or argument before passing it to the\n  factory. On shell runners, also strip `;`, `|`, `\u0026`, `$`, backtick,\n  and parentheses.\n- Or bypass the factory entirely and build the `ProcessConfiguration`\n  directly. Set `ArgumentList` explicitly to the argv you want the\n  runner to receive.\n\nThese are partial mitigations. They shift the quoting problem to your\ncode.",
  "id": "GHSA-j73w-8hfr-4gc9",
  "modified": "2026-09-25T21:41:36Z",
  "published": "2026-09-25T21:41:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/alastairlundy/CliInvoke/security/advisories/GHSA-j73w-8hfr-4gc9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100369"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alastairlundy/CliInvoke/commit/1e98582f02eb43e345e5b97b8dd6ff9443806685"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alastairlundy/CliInvoke/commit/fac321c7cc9cf4372919842701829ca2be5e7307"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/alastairlundy/CliInvoke"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alastairlundy/CliInvoke/releases/tag/2.10.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alastairlundy/CliInvoke/releases/tag/3.0.0-beta.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CliInvoke: Argument Injection in Extensibility Runner Factory"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.