Technical impact
CliInvoke is a .NET library for invoking command‑line programs, and its specialized wrappers for PowerShell and Windows Command Prompt include a flaw that allows an attacker to inject operating‑system commands via untrusted input. The wrappers concatenate caller‑controlled target and arguments into a single ProcessStartInfo.Arguments string passed to pwsh -Command or cmd /c. By inserting a double quote, the untrusted input can break OS‑level quoting and cause the shell to execute an additional command using the host process’s privileges. This is an instance of OS command injection (CWE‑78) and can lead to remote code execution with the rights of the running process.
Affected Systems
Versions of the library identified as alastairlundy:CliInvoke.Specializations and AlastairLundy.CliInvoke.Specializations between 2.2.0 and 2.8.4, 2.9.0 and 2.9.3, 2.10.0 and 2.10.4, 3.0.0‑alpha.1 to 3.0.0‑alpha.4, 3.0.0‑alpha.8 to 3.0.0‑alpha.10, as well as AlastairLundy.CliInvoke.Specializations 1.0.0‑rc.1 through 1.6.1.1 are affected. The vulnerability is fixed in CliInvoke.Specializations 2.8.5, 2.9.4, 2.10.5, 3.0.0‑beta.1 and AlastairLundy.CliInvoke.Specializations 2.0.2.
Risk and Exploitability
The CVSS score of 8.4 reflects a high‑severity flaw that can lead to remote code execution. The EPSS score is not available, but the absence of a KEV listing does not reduce the likelihood of exploitation in real world scenarios where untrusted input is passed to these wrapper functions. An attacker who can influence the arguments fed to the PowerShell or Cmd wrapper can execute arbitrary shell commands with the privileges of the host process. The exploit is straightforward because it relies on basic quoting manipulation and does not require advanced techniques or access to privileged APIs.
Github GHSA