CVE-2026-100369 alastairlundy CVE debrief

Who should care

Defenders responsible for .NET systems using CliInvoke or AlastairLundy.CliInvoke should assess exposure and prioritize upgrading to patched versions. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams that need to verify system configurations and inventory checks for affected versions.

Why it matters

CVE-2026-100369 is an argument-injection vulnerability in CliInvoke and AlastairLundy.CliInvoke .NET libraries, allowing for potential arbitrary command execution when a shell runner is used. Defenders should prioritize upgrading to patched versions or implementing partial mitigations.

• Potential arbitrary command execution when a shell runner is used.
• Possible lateral movement and escalation of privileges.
• Need for immediate upgrade or partial mitigation to prevent exploitation.
• Verification of system configurations and inventory checks for affected versions.

Technical summary

The vulnerability is caused by the RunnerProcessFactory and RunnerConfigurationFactory combining runner arguments, a caller-controlled target, and caller-controlled arguments into one ProcessStartInfo.Arguments string. This allows a double quote in the target or an argument to terminate an operating-system-level quoted region and inject unintended elements into the runner's argument vector, potentially resulting in arbitrary command execution when a shell runner is used.

Defensive priority

Defenders should prioritize upgrading to patched versions of CliInvoke and AlastairLundy.CliInvoke. For systems that cannot be upgraded, partial mitigation can be achieved by removing double quotes from targets and arguments, and removing shell metacharacters when using shell runners.

Recommended defensive actions

• Upgrade to patched versions of CliInvoke and AlastairLundy.CliInvoke.
• For systems that cannot be upgraded, remove double quotes from targets and arguments, and remove shell metacharacters when using shell runners.
• Bypass the vulnerable factory and construct a ProcessConfiguration with an explicit ArgumentList.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by the RunnerProcessFactory and RunnerConfigurationFactory combining runner arguments, a caller-controlled target, and caller-controlled arguments into one ProcessStartInfo.Arguments string. This allows a double quote in the target or an argument to terminate an operating-system-level quoted region and inject unintended elements into the runner's argument vector.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.