High, CVSS 8.4NuGetAmendedPublished
CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers
CVE-2026-100368 · GHSA-wrvw-254r-wpmv
- Affected
- NuGet cliinvoke.specializations >= 2.2.0, <= 2.8.4; >= 2.9.0, <= 2.9.3; >= 2.10.0, <= 2.10.4; >= 3.0.0-alpha.1, <= 3.0.0-alpha.4; >= 3.0.0-alpha.8, <= 3.0.0-alpha.10
- Fixed in
- 2.9.42.10.53.0.0-beta.12.8.5· Vendor fix available
- Issue
- Impact An OS command injection vulnerability exists in the PowerShell and Cmd shell wrappers provided by the CliInvoke.Specializations package (the PowershellProcessInvoker/CmdProcessInvoker invokers, and the UsePowerShell/UseCmd middleware in v3 pre-release versions). The wrappers re-run a caller-supplied target and arguments inside a shell command (pwsh -Command ... / cmd /c ...). In affected versions the wrapped command was delivered to the operating system as a single ProcessStartInfo.Arguments string. The OS command-line parser re-tokenizes that string before the shell parses it, so a double quote (") in the target or arguments breaks OS-level quoting and lets the wrapped shell reassemble a second, unintended command. An attacker could exploit this to execute arbitrary commands with the privileges of the host process. Patches The Specializations Packages now deliver the command via ProcessStartInfo.ArgumentList (natively where supported, and polyfilled in older TFMs), so that…
Recommended action: Upgrade to 3.0.0-beta.1 (pre-release), 2.10.5, 2.9.4 or 2.8.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.