CliInvoke and its former name AlastairLundy.CliInvoke contain an argument‑injection flaw in the RunnerProcessFactory for the 2.x line and in the RunnerConfigurationFactory for the 3.x line. The factories concatenate caller‑controlled targets and arguments into a single ProcessStartInfo.Arguments string without proper quoting, allowing an injected double quote to terminate a quoted region and insert unintended arguments. When a shell runner is used, this can lead to arbitrary command execution controlled by an attacker through crafted input. CWE‑88 identifies the underlying weakness in the code that concatenates arguments insecurely.

The vulnerability affects the .NET libraries CliInvoke and AlastairLundy.CliInvoke from the author alastairlundy. Affected editions include CliInvoke versions 2.0.0 to 2.8.4, 2.9.0 to 2.9.3, 2.10.0 to 2.10.4 and preliminary releases 3.0.0‑alpha.1 to 3.0.0‑beta.1, as well as AlastairLundy.CliInvoke versions 2.0.0‑alpha.1 to 2.0.0. The flaw is patched in CliInvoke 2.8.5, 2.9.4, 2.10.5 and 3.0.0‑beta.2, and in AlastairLundy.CliInvoke 2.0.2. Applications that integrate these libraries and rely on shell runners are at risk if they supply untrusted arguments.

The CVSS score of 8.4 indicates a high severity vulnerability. No EPSS score is available, but the lack of a CISA KEV entry suggests that exploitation has not yet been verified in the wild. The flaw can be exploited by any code that feeds untrusted input into the vulnerable factories, and because shell runners are required for the payload to be executed, the attack vector is likely application‑level with the attacker controlling the arguments. External input that contains double quotes or shell metacharacters can trigger unintended command execution, potentially giving attackers full control of the process host. Given the high CVSS and the potential for arbitrary code execution in environments that use these libraries, the risk remains significant for affected deployments.