High, CVSS 8.4NuGetAmendedPublished
CliInvoke: Argument Injection in Extensibility Runner Factory
CVE-2026-100369 · GHSA-j73w-8hfr-4gc9
- Affected
- NuGet cliinvoke >= 2.0.0, <= 2.8.4; >= 2.9.0, <= 2.9.3; >= 2.10.0, <= 2.10.4; >= 3.0.0-alpha.1, <= 3.0.0-beta.1
- Fixed in
- 3.0.0-beta.22.9.42.10.52.8.5· Vendor fix available
- Issue
- Impact An argument-injection vulnerability exists in the CliInvoke package's runner factory: RunnerProcessFactory on the 2.x line and RunnerConfigurationFactory on the 3.x line. The factory joins the runner arguments, the caller's target, and the caller's arguments into a single ProcessStartInfo.Arguments string and hands it to the OS. The OS command-line parser re-tokenizes the string before the runner sees it. A double quote (") in the target or in any argument closes the OS-level quoted region and lets the next character enter argv as a separate element. Patches Upgrade to: - 2.8.5 (2.8.x line) - 2.9.4 (2.9.x line) - 2.10.5 (2.10.x line) - 3.0.0-beta.2 (3.x pre-release line) Workarounds No complete workaround is available. Until you can upgrade: - Strip " from any target or argument before passing it to the factory. On shell runners, also strip ;, |, &, $, backtick, and parentheses. - Or bypass the factory entirely and build the ProcessConfiguration directly. Set ArgumentList…
Recommended action: Upgrade to 3.0.0-beta.2 (pre-release), 2.10.5, 2.9.4 or 2.8.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.