Cliinvoke Specializations
Monthly
OS command injection in the PowerShell and Cmd wrapper classes of the CliInvoke.Specializations .NET library (and its predecessor package AlastairLundy.CliInvoke.Specializations) lets a double quote embedded in caller-controlled target paths or arguments break OS-level quoting of the single ProcessStartInfo.Arguments string, causing pwsh -Command or cmd /c to execute an additional command with the host process's privileges. Affected builds are CliInvoke.Specializations 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, and 3.0.0-alpha.1 through alpha.4 plus 3.0.0-alpha.8 through alpha.10, as well as AlastairLundy.CliInvoke.Specializations 1.0.0-rc.1 through 1.6.1.1; an application is only reachable if it consumes one of these vulnerable versions, uses the specialized shell wrappers rather than direct process invocation, and routes attacker-influenced data into the target or arguments. Rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) by reporter GitHub_M; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
OS command injection in the PowerShell and Cmd wrapper classes of the CliInvoke.Specializations .NET library (and its predecessor package AlastairLundy.CliInvoke.Specializations) lets a double quote embedded in caller-controlled target paths or arguments break OS-level quoting of the single ProcessStartInfo.Arguments string, causing pwsh -Command or cmd /c to execute an additional command with the host process's privileges. Affected builds are CliInvoke.Specializations 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, and 3.0.0-alpha.1 through alpha.4 plus 3.0.0-alpha.8 through alpha.10, as well as AlastairLundy.CliInvoke.Specializations 1.0.0-rc.1 through 1.6.1.1; an application is only reachable if it consumes one of these vulnerable versions, uses the specialized shell wrappers rather than direct process invocation, and routes attacker-influenced data into the target or arguments. Rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) by reporter GitHub_M; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.