Alastairlundy Cliinvoke
Monthly
Argument injection in the CliInvoke .NET process-wrapping library (and its former identity, AlastairLundy.CliInvoke) allows a double quote in a caller-supplied target or argument to break out of the operating-system-level quoted region and add unintended elements to a runner's argument vector, potentially escalating to arbitrary command execution when a shell runner is used. Affected versions span CliInvoke 2.0.0-2.8.4, 2.9.0-2.9.3, 2.10.0-2.10.4 and 3.0.0-alpha.1-3.0.0-beta.1, plus AlastairLundy.CliInvoke 2.0.0-alpha.1-2.0.0; the flaw is reachable only when a consuming .NET application routes attacker-influenced data through RunnerProcessFactory (2.x) or RunnerConfigurationFactory (3.x) instead of building a ProcessConfiguration with an explicit ArgumentList. Scored CVSS 3.1 8.4 (High) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, it carries no public exploit identified at time of analysis and is not in CISA KEV.
Argument injection in the CliInvoke .NET process-wrapping library (and its former identity, AlastairLundy.CliInvoke) allows a double quote in a caller-supplied target or argument to break out of the operating-system-level quoted region and add unintended elements to a runner's argument vector, potentially escalating to arbitrary command execution when a shell runner is used. Affected versions span CliInvoke 2.0.0-2.8.4, 2.9.0-2.9.3, 2.10.0-2.10.4 and 3.0.0-alpha.1-3.0.0-beta.1, plus AlastairLundy.CliInvoke 2.0.0-alpha.1-2.0.0; the flaw is reachable only when a consuming .NET application routes attacker-influenced data through RunnerProcessFactory (2.x) or RunnerConfigurationFactory (3.x) instead of building a ProcessConfiguration with an explicit ArgumentList. Scored CVSS 3.1 8.4 (High) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, it carries no public exploit identified at time of analysis and is not in CISA KEV.