CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers
An OS command injection vulnerability exists in the PowerShell and Cmd shell wrappers provided by the CliInvoke.Specializations package (the PowershellProcessInvoker/CmdProcessInvoker invokers, and the UsePowerShell/UseCmd middleware in v3 pre-release versions). The wrappers re-run a caller-supplied target and arguments inside a shell command (pwsh -Command … / cmd /c …). In affected versions the wrapped command was delivered to the operating system as a single ProcessStartInfo.Arguments string. The OS command-line parser re-tokenizes …