Argument Injection in CliInvoke Extensibility Runner Factory

The CliInvoke package, used for extensibility and runner management, contains an argument-injection vulnerability (CVE-2026-100369) within its process factory components, specifically the RunnerProcessFactory (2.x versions) and the RunnerConfigurationFactory (3.x versions). The vulnerability stems from the way these factories join runner arguments, targets, and caller arguments into a single string for ProcessStartInfo.Arguments.

When this string is passed to the operating system, the command-line parser re-tokenizes it. Because the library fails to sanitize input, an attacker can embed double quotes (") into a target or argument to close the intended quoted region prematurely. This allows subsequent characters to be interpreted by the OS as separate command-line arguments, potentially resulting in arbitrary command execution. This flaw affects multiple versions of CliInvoke and AlastairLundy.CliInvoke. Defenders should prioritize upgrading to the patched versions specified in the remediation section.

Impact

Successful exploitation allows for argument injection, which can be leveraged to execute arbitrary commands or manipulate program flow within the context of the calling application. This vulnerability impacts any application using the affected CliInvoke libraries to execute external processes with user-supplied input. There are currently no reports of widespread in-the-wild exploitation, but the ease of triggering this via malicious input makes it a significant risk for enterprise applications utilizing this library.

Recommendation

• Upgrade the CliInvoke package to the patched versions immediately: 2.8.5, 2.9.4, 2.10.5, or 3.0.0-beta.2.
• Audit applications utilizing CliInvoke for user-controllable input that is passed to the RunnerProcessFactory or RunnerConfigurationFactory.
• As a temporary mitigation, implement strict input validation to strip double quotes (") from all target and argument strings before they are passed to the factory.
• If using shell runners, also strip common shell meta-characters including ;, |, &, $, backticks, and parentheses.
• Transition to building ProcessConfiguration objects directly by setting ArgumentList explicitly, which avoids the flawed string concatenation approach used by the factory.