CVE-2026-100368: CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers
An OS command injection vulnerability exists in the PowerShell and Cmd shell wrappers provided by the CliInvoke.Specializations package (the PowershellProcessInvoker/CmdProcessInvoker invokers, and the UsePowerShell/UseCmd middleware in v3 pre-release versions).
The wrappers re-run a caller-supplied target and arguments inside a shell command (pwsh -Command ... / cmd /c ...). In affected versions the wrapped command was delivered to the operating system as a single ProcessStartInfo.Arguments string. The OS command-line parser re-tokenizes that string before the shell parses it, so a double quote (") in the target or arguments breaks OS-level quoting and lets the wrapped shell reassemble a second, unintended command.
An attacker could exploit this to execute arbitrary commands with the privileges of the host process.
References
- github.com/advisories/GHSA-wrvw-254r-wpmv
- github.com/alastairlundy/CliInvoke/commit/1e98582f02eb43e345e5b97b8dd6ff9443806685
- github.com/alastairlundy/CliInvoke/commit/2077e5239850e83dc9cc67ae6036dcd4e68a1876
- github.com/alastairlundy/CliInvoke/releases/tag/2.10.5
- github.com/alastairlundy/CliInvoke/releases/tag/3.0.0-beta.1
- github.com/alastairlundy/CliInvoke/security/advisories/GHSA-wrvw-254r-wpmv
- nvd.nist.gov/vuln/detail/CVE-2026-100368
Code Behaviors & Features
Detect and mitigate CVE-2026-100368 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →