CVE-2026-100368 alastairlundy CVE debrief

Who should care

Defenders responsible for .NET applications using CliInvoke.Specializations or AlastairLundy.CliInvoke.Specializations should assess exposure and prioritize patching vulnerable versions.

Why it matters

CVE-2026-100368 is an OS command injection vulnerability in CliInvoke.Specializations .NET library, allowing for execution of additional commands with host process privileges. Defenders should prioritize patching vulnerable versions and implement workarounds to prevent exploitation.

• OS command injection with host process privileges
• Potential for lateral movement and escalation
• Need for patching or workarounds to prevent exploitation
• Verification of input validation and sanitization

Technical summary

The CliInvoke.Specializations .NET library versions 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, 3.0.0-alpha.1 through 3.0.0-alpha.4, and 3.0.0-alpha.8 through 3.0.0-alpha.10, as well as AlastairLundy.CliInvoke.Specializations versions 1.0.0-rc.1 through 1.6.1.1, contain an OS command injection vulnerability in their PowerShell and Cmd wrappers. The wrappers pass a caller-controlled target and arguments to pwsh -Command or cmd /c using a single ProcessStartInfo.Arguments string, allowing a double quote in untrusted input to break operating-system-level quoting and cause the shell to execute an additional command with the host process's privileges.

Defensive priority

Defenders should prioritize patching vulnerable CliInvoke.Specializations and AlastairLundy.CliInvoke.Specializations versions as the vulnerability allows for OS command injection with host process privileges.

Recommended defensive actions

• Patch CliInvoke.Specializations and AlastairLundy.CliInvoke.Specializations to the latest versions
• Reject or remove double quotes from target paths and arguments
• Reject shell metacharacters in versions 2.2.0 through 2.9.2 and 3.0.0-alpha.1 through 3.0.0-alpha.4
• Bypass PowerShell and Cmd wrappers and invoke target processes directly when handling untrusted input
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and patched versions. A GitHub security advisory is also referenced. Defenders should verify input validation and sanitization, review compensating controls, and check relevant monitoring, detection, and logs for exposed assets. The vulnerability allows a double quote in untrusted input to break operating-system-level quoting and execute an additional command with the host process's privileges.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.