CliInvoke.Specializations CVE-2026-100368

Exploitation requires an application that (1) depends on a vulnerable version of CliInvoke.Specializations (2.2.0-2.8.4, 2.9.0-2.9.3, 2.10.0-2.10.4, 3.0.0-alpha.1-alpha.4, 3.0.0-alpha.8-alpha.10, or AlastairLundy.CliInvoke.Specializations 1.0.0-rc.1-1.6.1.1), (2) uses specifically the PowerShell (pwsh -Command) or Cmd (cmd /c) specialized wrappers rather than direct process invocation, and (3) passes attacker-influenced data as the target path or arguments. The concrete injection primitive is a double quote in untrusted input that breaks OS-level quoting of the single ProcessStartInfo.Arguments string. Limiting factors: the flaw is a library dependency (AV:L), so it is only reachable if untrusted input flows into these wrappers; no complete workaround exists, but rejecting/removing double quotes (plus shell metacharacters in versions 2.2.0-2.9.2 and 3.0.0-alpha.1-alpha.4) or bypassing the wrappers mitigates it.

This is a CWE-78 OS command injection in the PowerShell/Cmd wrapper classes of the CliInvoke.Specializations .NET library, rated CVSS 8.4 by the reporter (GitHub_M) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The AV:L (local) axis is the key nuance: the flaw lives inside a library, so 'exploitation' means untrusted data reaching an application that uses the vulnerable wrapper - the real attack vector inherits the consuming app's exposure, which could effectively be network-facing if the host app passes remote input to pwsh -Command or cmd /c. The technical impact is genuinely high (arbitrary command execution with the host process's privileges → full C/I/A), which justifies the elevated score. However, tempering signals: no EPSS score, no CISA KEV listing, and no public exploit code are present in the input - no public exploit identified at time of analysis. There is no evidence of active exploitation, and exploitability is entirely contingent on a downstream application both using these wrappers AND feeding them attacker-controllable strings containing a double quote. This is a real, patch-worthy defect for anyone shipping this dependency, but its aggregate real-world risk is bounded by the library's niche footprint and the dependency on how consumers wire untrusted input, rather than being a broadly automatable internet-facing threat.

An application built on CliInvoke.Specializations passes a user-supplied file path or argument (e.g. from a web form or CLI parameter) into the PowerShell or Cmd wrapper. The attacker includes a double quote to break OS-level quoting - for example a path like foo" & malicious-command &" - causing the shell to run an additional attacker-chosen command with the host process's privileges. No public exploit code is identified, but the technique is straightforward given the disclosed root cause (single ProcessStartInfo.Arguments string).