CVE-2026-100369

CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libraries for invoking command-line programs and wrapping executable processes. `CliInvoke` versions 2.0.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, and 3.0.0-alpha.1 through 3.0.0-beta.1, as well as `AlastairLundy.CliInvoke` versions 2.0.0-alpha.1 through 2.0.0, contain an argument-injection vulnerability in `RunnerProcessFactory` on the 2.x line and `RunnerConfigurationFactory` on the 3.x line. These factories combine runner arguments, a caller-controlled target, and caller-controlled arguments into one `ProcessStartInfo.Arguments` string, allowing a double quote in the target or an argument to terminate an operating-system-level quoted region and inject unintended elements into the runner’s argument vector, potentially resulting in arbitrary command execution when a shell runner is used. The vulnerability is patched in `CliInvoke` versions 2.8.5, 2.9.4, 2.10.5, and 3.0.0-beta.2, and in `AlastairLundy.CliInvoke` version 2.0.2. No complete workaround is available; users unable to upgrade can partially mitigate the issue by removing double quotes from targets and arguments, additionally removing shell metacharacters when using shell runners, or bypassing the vulnerable factory and constructing a `ProcessConfiguration` with an explicit `ArgumentList`.

• CWE-88

• https://github.com/alastairlundy/CliInvoke/security/advisories/GHSA-j73w-8hfr-4gc9

Published

Sep 25, 2026

Last Modified

Sep 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100361SuiteCRM is an open-source, enterprise-ready Customer Relati…7.1
• CVE-2026-100362SuiteCRM is an open-source, enterprise-ready Customer Relati…6.9
• CVE-2026-100363SuiteCRM is an open-source, enterprise-ready Customer Relati…8.8
• CVE-2026-100364SuiteCRM is an open-source, enterprise-ready Customer Relati…7.1
• CVE-2026-100365SuiteCRM is an open-source, enterprise-ready Customer Relati…8.8
• CVE-2026-100368CliInvoke is a .NET library for invoking command-line progra…8.4
• CVE-2026-10037A sandbox escape vulnerability exists in the OpenJDK package…8.8
• CVE-2026-100370DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Pri…4.7
• CVE-2026-100371InvoicePlane is a self-hosted open source application for ma…8.7
• CVE-2026-100372ClipBucket v5 before 5.5.3-#197 contains a path traversal vu…7.2
• CVE-2026-100373OpenMetadata through 2.0.2 contains a server-side request fo…4.1
• CVE-2026-100376Improper Neutralization of Input During Web Page Generation …4.8