CliInvoke: Argument Injection in Extensibility Runner Factory
An argument-injection vulnerability exists in the CliInvoke package's runner factory: RunnerProcessFactory on the 2.x line and RunnerConfigurationFactory on the 3.x line. The factory joins the runner arguments, the caller's target, and the caller's arguments into a single ProcessStartInfo.Arguments string and hands it to the OS. The OS command-line parser re-tokenizes the string before the runner sees it. A double quote (") in the target or in any argument closes the …