CVE-2026-100368: CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers
An OS command injection vulnerability exists in the PowerShell and Cmd shell wrappers provided by the CliInvoke.Specializations package (the PowershellProcessInvoker/CmdProcessInvoker invokers, and the UsePowerShell/UseCmd middleware in v3 pre-release versions).
The wrappers re-run a caller-supplied target and arguments inside a shell command (pwsh -Command ... / cmd /c ...). In affected versions the wrapped command was delivered to the operating system as a single ProcessStartInfo.Arguments string. The OS command-line parser re-tokenizes that string before the shell parses it, so a double quote (") in the target or arguments breaks OS-level quoting and lets the wrapped shell reassemble a second, unintended command.
An attacker could exploit this to execute arbitrary commands with the privileges of the host process.
References
- github.com/advisories/GHSA-wrvw-254r-wpmv
- github.com/alastairlundy/CliInvoke/commit/1e98582f02eb43e345e5b97b8dd6ff9443806685
- github.com/alastairlundy/CliInvoke/commit/2077e5239850e83dc9cc67ae6036dcd4e68a1876
- github.com/alastairlundy/CliInvoke/releases/tag/2.10.5
- github.com/alastairlundy/CliInvoke/releases/tag/3.0.0-beta.1
- github.com/alastairlundy/CliInvoke/security/advisories/GHSA-wrvw-254r-wpmv
- nvd.nist.gov/vuln/detail/CVE-2026-100368
Code Behaviors & Features
Detect and mitigate CVE-2026-100368 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →