All vulnerabilities
CVE-2026-100369GHSA-j73w-8hfr-4gc9

CliInvoke: Argument Injection in Extensibility Runner Factory

alastairlundy CliInvokenugetLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.4High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.8.5Also 2.9.4, 2.10.5 and 2 moreGitHub
Published25 Sep 2026Updated 28 Sep 2026CVE List

What fixes it

  • 2.8.5CliInvoke, nugetGitHubdotnet add package CliInvoke --version 2.8.5
  • 2.9.4CliInvoke, nugetGitHubdotnet add package CliInvoke --version 2.9.4
  • 2.10.5CliInvoke, nugetGitHubdotnet add package CliInvoke --version 2.10.5
  • 3.0.0-beta.2CliInvoke, nugetGitHubdotnet add package CliInvoke --version 3.0.0-beta.2
  • 2.0.2AlastairLundy.CliInvoke, nugetGitHubdotnet add package AlastairLundy.CliInvoke --version 2.0.2
  • 2.8.5CliInvoke, NuGetOSVdotnet add package CliInvoke --version 2.8.5
Show all 10 fixed versions
  • 2.9.4CliInvoke, NuGetOSVdotnet add package CliInvoke --version 2.9.4
  • 2.10.5CliInvoke, NuGetOSVdotnet add package CliInvoke --version 2.10.5
  • 3.0.0-beta.2CliInvoke, NuGetOSVdotnet add package CliInvoke --version 3.0.0-beta.2
  • 2.0.2AlastairLundy.CliInvoke, NuGetOSVdotnet add package AlastairLundy.CliInvoke --version 2.0.2

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

An argument-injection vulnerability exists in the CliInvoke package's runner factory: RunnerProcessFactory on the 2.x line and RunnerConfigurationFactory on the 3.x line.

The factory joins the runner arguments, the caller's target, and the caller's arguments into a single ProcessStartInfo.Arguments string and hands it to the OS. The OS command-line parser re-tokenizes the string before the runner sees it. A double quote (") in the target or in any argument closes the OS-level quoted region and lets the next character enter argv as a separate element.

Patches

Upgrade to:

  • 2.8.5 (2.8.x line)
  • 2.9.4 (2.9.x line)
  • 2.10.5 (2.10.x line)
  • 3.0.0-beta.2 (3.x pre-release line)

Workarounds

No complete workaround is available. Until you can upgrade:

  • Strip " from any target or argument before passing it to the

factory. On shell runners, also strip ;, |, &, $, backtick, and parentheses.

  • Or bypass the factory entirely and build the ProcessConfiguration

directly. Set ArgumentList explicitly to the argv you want the runner to receive.

These are partial mitigations. They shift the quoting problem to your code.

Text from GitHub Advisory Database

Affected versions 60

  • CliInvoke, nuget>= 2.0.0, <= 2.8.4GitHub
  • CliInvoke, nuget>= 2.9.0, <= 2.9.3GitHub
  • CliInvoke, nuget>= 2.10.0, <= 2.10.4GitHub
  • CliInvoke, nuget>= 3.0.0-alpha.1, <= 3.0.0-beta.1GitHub
  • AlastairLundy.CliInvoke, nuget>= 2.0.0-alpha.1, <= 2.0.0GitHub
  • CliInvokeaffected: >= 2.0.0, <= 2.8.4CVE List
  • CliInvokeaffected: >= 2.9.0, <= 2.9.3CVE List
  • CliInvokeaffected: >= 2.10.0, <= 2.10.4CVE List
  • CliInvokeaffected: >= 3.0.0-alpha.1, <= 3.0.0-beta.1CVE List
  • AlastairLundy.CliInvokeaffected: >= 2.0.0-alpha.1, <= 2.0.0CVE List
  • CliInvoke, NuGetfrom 2.0.0, fixed in 2.8.5OSV
  • CliInvoke, NuGet2.0.0OSV
  • CliInvoke, NuGet2.0.1OSV
  • CliInvoke, NuGet2.1.0OSV
  • CliInvoke, NuGet2.1.1OSV
  • CliInvoke, NuGet2.1.2OSV
  • CliInvoke, NuGet2.1.3OSV
  • CliInvoke, NuGet2.1.4OSV
  • CliInvoke, NuGet2.1.5OSV
  • CliInvoke, NuGet2.2.0OSV
  • CliInvoke, NuGet2.2.1OSV
  • CliInvoke, NuGet2.3.0OSV
  • CliInvoke, NuGet2.3.1OSV
  • CliInvoke, NuGet2.3.2OSV
  • CliInvoke, NuGet2.3.3OSV
  • CliInvoke, NuGet2.3.4OSV
  • CliInvoke, NuGet2.4.0OSV
  • CliInvoke, NuGet2.4.1OSV
  • CliInvoke, NuGet2.4.2OSV
  • CliInvoke, NuGet2.4.3OSV
  • CliInvoke, NuGet2.4.4OSV
  • CliInvoke, NuGet2.4.5OSV
  • CliInvoke, NuGet2.5.0OSV
  • CliInvoke, NuGet2.5.1OSV
  • CliInvoke, NuGet2.5.2OSV
  • CliInvoke, NuGet2.5.3OSV
  • CliInvoke, NuGet2.5.4OSV
  • CliInvoke, NuGet2.6.0OSV
  • CliInvoke, NuGet2.6.1OSV
  • CliInvoke, NuGet2.7.0OSV
  • CliInvoke, NuGet2.7.1OSV
  • CliInvoke, NuGet2.7.2OSV
  • CliInvoke, NuGet2.8.0OSV
  • CliInvoke, NuGet2.8.1OSV
  • CliInvoke, NuGet2.8.2OSV
  • CliInvoke, NuGet2.8.3OSV
  • CliInvoke, NuGet2.8.4OSV
  • CliInvoke, NuGetfrom 2.9.0, fixed in 2.9.4OSV
  • CliInvoke, NuGet2.9.0OSV
  • CliInvoke, NuGet2.9.1OSV
  • CliInvoke, NuGet2.9.2OSV
  • CliInvoke, NuGet2.9.3OSV
  • CliInvoke, NuGetfrom 2.10.0, fixed in 2.10.5OSV
  • CliInvoke, NuGet2.10.1OSV
  • CliInvoke, NuGet2.10.2OSV
  • CliInvoke, NuGet2.10.3OSV
  • CliInvoke, NuGet2.10.4OSV
  • CliInvoke, NuGetfrom 3.0.0-alpha.1, fixed in 3.0.0-beta.2OSV
  • AlastairLundy.CliInvoke, NuGetfrom 2.0.0-alpha.1, fixed in 2.0.2OSV
  • AlastairLundy.CliInvoke, NuGet2.0.0OSV

References 7