Command injection flaw found in .NET shell wrapper CliInvoke

A vulnerability disclosed on 25 September 2026 affects CliInvoke, a .NET library for invoking command-line programs, and specifically its CliInvoke.Specializations packages, which provide wrappers for shells such as PowerShell and the Windows Command Prompt. According to the entry for CVE-2026-100368 in the US National Vulnerability Database, the wrappers contain an operating-system command injection flaw that lets untrusted input execute arbitrary commands with the privileges of the host process. The maintainer, Alastair Lundy, has published fixed versions.

The cause is how the wrappers build their command line. The advisory says they pass a caller-controlled target and arguments to pwsh -Command or cmd /c using a single ProcessStartInfo.Arguments string. Because everything is concatenated into one string, a double quote in untrusted input can break the quoting that the operating system relies on to tell one argument from the next. The shell then treats part of the input as a separate instruction and runs an additional command.

That matters for any software that takes a file path, a program name or an argument from somewhere it does not control and hands it to one of these wrappers. That includes automated tooling and coding agents that assemble shell commands on a user's behalf, where the input may come from a prompt, a repository or a remote service.

The affected releases are extensive. According to the NVD entry, CliInvoke.Specializations versions 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, 3.0.0-alpha.1 through 3.0.0-alpha.4, and 3.0.0-alpha.8 through 3.0.0-alpha.10 are vulnerable, as are AlastairLundy.CliInvoke.Specializations versions 1.0.0-rc.1 through 1.6.1.1.

Fixes are available in CliInvoke.Specializations versions 2.8.5, 2.9.4, 2.10.5 and 3.0.0-beta.1, and in AlastairLundy.CliInvoke.Specializations version 2.0.2. Because the maintainer has patched several branches in parallel, users need to pick the fixed release that matches the line they are already on rather than assuming the highest number is the right one.

The advisory is blunt about mitigation: no complete workaround is available. For those who cannot upgrade, it suggests rejecting or removing double quotes from target paths and arguments. For the older ranges, versions 2.2.0 through 2.9.2 and 3.0.0-alpha.1 through 3.0.0-alpha.4, it says callers should additionally reject shell metacharacters, the punctuation that shells treat as instructions rather than text. The other option given is to bypass the PowerShell and Cmd wrappers altogether and invoke the target process directly when handling untrusted input.

That last suggestion is the most robust of the three, because invoking a process directly avoids handing a string to a shell for re-parsing in the first place. Filtering quotes and metacharacters is a denylist approach, and denylists depend on the author having anticipated every dangerous character.

The advisory does not report any exploitation of the flaw. Details are published in the project's GitHub security advisory, GHSA-wrvw-254r-wpmv, which is the reference cited by the NVD record.