{"id":"CVE-2026-100369","aliases":["GHSA-j73w-8hfr-4gc9"],"url":"https://o3.security/vulnerability/CVE-2026-100369","summary":"CliInvoke: Argument Injection in Extensibility Runner Factory","details":"### Impact\nAn argument-injection vulnerability exists in the `CliInvoke`\npackage's runner factory: `RunnerProcessFactory` on the 2.x line and\n`RunnerConfigurationFactory` on the 3.x line.\n\nThe factory joins the runner arguments, the caller's target, and the\ncaller's arguments into a single `ProcessStartInfo.Arguments` string and\nhands it to the OS. The OS command-line parser re-tokenizes the string\nbefore the runner sees it. A double quote (`\"`) in the target or in any\nargument closes the OS-level quoted region and lets the next character\nenter argv as a separate element.\n\n### Patches\nUpgrade to:\n\n- **2.8.5** (2.8.x line)\n- **2.9.4** (2.9.x line)\n- **2.10.5** (2.10.x line)\n- **3.0.0-beta.2** (3.x pre-release line)\n\n### Workarounds\nNo complete workaround is available. Until you can upgrade:\n\n- Strip `\"` from any target or argument before passing it to the\n  factory. On shell runners, also strip `;`, `|`, `&`, `$`, backtick,\n  and parentheses.\n- Or bypass the factory entirely and build the `ProcessConfiguration`\n  directly. Set `ArgumentList` explicitly to the argv you want the\n  runner to receive.\n\nThese are partial mitigations. They shift the quoting problem to your\ncode.","published":"2026-09-25T20:26:51.352Z","modified":"2026-10-21T02:54:29.631466347Z","cvss":{"score":8.4,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"NuGet","name":"CliInvoke","fixedVersion":"2.8.5"},{"ecosystem":"NuGet","name":"CliInvoke","fixedVersion":"2.9.4"},{"ecosystem":"NuGet","name":"CliInvoke","fixedVersion":"2.10.5"},{"ecosystem":"NuGet","name":"CliInvoke","fixedVersion":"3.0.0-beta.2"},{"ecosystem":"NuGet","name":"AlastairLundy.CliInvoke","fixedVersion":"2.0.2"}],"fix":{"url":"https://github.com/alastairlundy/CliInvoke/commit/1e98582f02eb43e345e5b97b8dd6ff9443806685","label":"alastairlundy/CliInvoke@1e98582"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100369.json"},{"type":"ADVISORY","url":"https://github.com/alastairlundy/CliInvoke/security/advisories/GHSA-j73w-8hfr-4gc9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100369"},{"type":"WEB","url":"https://github.com/alastairlundy/CliInvoke/commit/1e98582f02eb43e345e5b97b8dd6ff9443806685"},{"type":"WEB","url":"https://github.com/alastairlundy/CliInvoke/commit/fac321c7cc9cf4372919842701829ca2be5e7307"},{"type":"PACKAGE","url":"https://github.com/alastairlundy/CliInvoke"},{"type":"WEB","url":"https://github.com/alastairlundy/CliInvoke/releases/tag/2.10.5"},{"type":"WEB","url":"https://github.com/alastairlundy/CliInvoke/releases/tag/3.0.0-beta.2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:54:29.631466347Z"}}