EUVD-2026-87354
GHSA-j73w-8hfr-4gc9
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:L because it is a library processing local application-supplied input, not a network service; PR:N/UI:N as no auth or interaction is intrinsic to the library; C/I/A:H reflect the arbitrary-command-execution outcome via a shell runner.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
CliInvoke and its formerly named AlastairLundy.CliInvoke package are .NET libraries for invoking command-line programs and wrapping executable processes. CliInvoke versions 2.0.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, and 3.0.0-alpha.1 through 3.0.0-beta.1, as well as AlastairLundy.CliInvoke versions 2.0.0-alpha.1 through 2.0.0, contain an argument-injection vulnerability in RunnerProcessFactory on the 2.x line and RunnerConfigurationFactory on the 3.x line. These factories combine runner arguments, a caller-controlled target, and caller-controlled arguments into one ProcessStartInfo.Arguments string, allowing a double quote in the target or an argument to terminate an operating-system-level quoted region and inject unintended elements into the runner’s argument vector, potentially resulting in arbitrary command execution when a shell runner is used. The vulnerability is patched in CliInvoke versions 2.8.5, 2.9.4, 2.10.5, and 3.0.0-beta.2, and in AlastairLundy.CliInvoke version 2.0.2. No complete workaround is available; users unable to upgrade can partially mitigate the issue by removing double quotes from targets and arguments, additionally removing shell metacharacters when using shell runners, or bypassing the vulnerable factory and constructing a ProcessConfiguration with an explicit ArgumentList.
AnalysisAI
Argument injection in the CliInvoke .NET process-wrapping library (and its former identity, AlastairLundy.CliInvoke) allows a double quote in a caller-supplied target or argument to break out of the operating-system-level quoted region and add unintended elements to a runner's argument vector, potentially escalating to arbitrary command execution when a shell runner is used. Affected versions span CliInvoke 2.0.0-2.8.4, 2.9.0-2.9.3, 2.10.0-2.10.4 and 3.0.0-alpha.1-3.0.0-beta.1, plus AlastairLundy.CliInvoke 2.0.0-alpha.1-2.0.0; the flaw is reachable only when a consuming .NET application routes attacker-influenced data through RunnerProcessFactory (2.x) or RunnerConfigurationFactory (3.x) instead of building a ProcessConfiguration with an explicit ArgumentList. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a consuming .NET application to (1) use CliInvoke's RunnerProcessFactory (2.x) or RunnerConfigurationFactory (3.x) - rather than constructing a ProcessConfiguration with an explicit ArgumentList - and (2) pass attacker-influenced data as the target or an argument. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a CWE-88 argument-injection flaw in the CliInvoke / AlastairLundy.CliInvoke .NET process-wrapping libraries, scored CVSS 3.1 8.4 (High) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are CliInvoke 2.8.5, 2.9.4, 2.10.5, and 3.0.0-beta.2, and AlastairLundy.CliInvoke 2.0.2; upgrade to the appropriate fixed version for the branch you ship, per the advisory at https://github.com/alastairlundy/CliInvoke/security/advisories/GHSA-j73w-8hfr-4gc9. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all .NET applications and dependencies referencing CliInvoke 2.0.0-2.8.4, 2.9.0-2.9.3, 2.10.0-2.10.4, 3.0.0-alpha.1-3.0.0-beta.1, and AlastairLundy.CliInvoke 2.0.0-alpha.1-2.0.0; identify whether any route attacker-influenced data through RunnerProcessFactory (2.x) or RunnerConfigurationFactory (3.x), and immediately refactor or block those paths by using ProcessConfiguration with an explicit ArgumentList, disabling shell runners, and validating or sanitizing all target and argument values. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Changjetong T+ (through 16.x) has .NET deserialization RCE in an AjaxPro endpoint. Attacker-controlled JSON triggers des
SQL injection (CWE-89) in Marten, the .NET transactional document DB and event store for PostgreSQL, affects versions 7.
SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL st
PowerDocu versions prior to 2.4.0 allow arbitrary .NET object instantiation and code execution through unsafe deserializ
Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a net
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML
Asp.Net-Core-Inventory-Order-Management-System versions up to 9.20250118. contains a security vulnerability (CVSS 6.3).
Remote code execution in the ActiveMQ NMS AMQP .NET client affects all releases up to and including 2.3.0 when the clien
Insecure .NET Remoting deserialization in Altec DocLink (Beyond Limits) 4.0.336.0. Exposed TCP endpoints allow unauthent
Information disclosure in Steeltoe's Management Endpoint actuator (Steeltoe.Management.Endpoint) prior to 4.3.0 allows a
Share
External POC / Exploit Code
Leaving vuln.today