CliInvoke OS command injection vulnerability

CliInvoke.Specializations and AlastairLundy.CliInvoke.Specializations contain an OS command injection vulnerability in PowerShell and Cmd wrappers that allows untrusted input with double quotes to execute arbitrary commands. The vulnerability has been patched in recent versions.

Disclosed 25 September 2026 · Record updated 1 October 2026

Impact

OS command injection vulnerability allowing arbitrary command execution with host process privileges through untrusted input in PowerShell and Cmd wrappers.

Our coverage

A puppet master's strings snap when a stray wire tangles through them, suddenly jerking the marionette to execute unexpected movements.

Vulnerabilities

Command injection flaw found in .NET shell wrapper CliInvoke

A double quote in untrusted input could break shell quoting and run extra commands, according to an advisory published on 25 September 2026.

25 Sept 2026

Sources

nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-100368