CliInvoke and AlastairLundy.CliInvoke .NET libraries for invoking command-line programs have an argument injection vulnerability (CWE-88) in the RunnerProcessFactory (2.x) and RunnerConfigurationFactory (3.x). These factories improperly combine runner arguments, a caller-controlled target, and caller-controlled arguments into a single ProcessStartInfo.Arguments string. This allows a double quote in the target or arguments to break out of the quoted region and inject unintended command-line elements, potentially leading to arbitrary command execution when a shell runner is used. The vulnerability affects CliInvoke versions 2.0.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, and 3.0.0-alpha.1 through 3.0.0-beta.1, as well as AlastairLundy.CliInvoke versions 2.0.0-alpha.1 through 2.0.0. Patches are available in CliInvoke versions 2.8.5, 2.9.4, 2.10.5, 3.0.0-beta.2, and AlastairLundy.CliInvoke version 2.0.2. No complete workaround is available; partial mitigations include removing double quotes and shell metacharacters from inputs or bypassing the vulnerable factories by constructing ProcessConfiguration with explicit ArgumentList.

Successful exploitation can result in arbitrary command execution with the privileges of the running process, leading to full compromise of the affected application environment. The vulnerability has a CVSS 3.1 score of 8.4 (high severity), indicating high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

A fix is available in CliInvoke versions 2.8.5, 2.9.4, 2.10.5, 3.0.0-beta.2, and AlastairLundy.CliInvoke version 2.0.2. Users are strongly advised to upgrade to these patched versions. No complete workaround exists; however, users unable to upgrade can partially mitigate risk by removing double quotes from targets and arguments, removing shell metacharacters when using shell runners, or bypassing the vulnerable factories by constructing a ProcessConfiguration with an explicit ArgumentList.