A critical OS command injection vulnerability in the CliInvoke.Specializations library allows unauthenticated attackers to execute arbitrary commands with the privileges of the host process.

This is an OS command injection flaw (CWE-78) where the library fails to properly sanitize input before passing it to pwsh -Command or cmd /c. By injecting double quotes into target paths or arguments, an unauthenticated attacker can break out of the intended command string to execute malicious payloads.

The ability to execute arbitrary OS commands poses a severe risk to data confidentiality, integrity, and availability. Because the injected commands run with the privileges of the host process, an attacker could gain full control over the affected system, exfiltrate sensitive data, or deploy persistent malware. Given the CVSS score of 8.4, this vulnerability represents a high-risk security gap that could lead to complete system compromise.

Immediate Action: Update CliInvoke.Specializations to versions 2.8.5, 2.9.4, 2.10.5, or 3.0.0-beta.1, and update AlastairLundy.CliInvoke.Specializations to version 2.0.2.

Proactive Monitoring: Review application logs for suspicious process spawning or unexpected command-line arguments involving shell metacharacters or quotation marks.

Compensating Controls: If patching is not immediately feasible, sanitize all input to reject double quotes and shell metacharacters, or invoke target processes directly without utilizing the vulnerable PowerShell or Cmd wrappers.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to any .NET application utilizing the affected library for command execution. Security teams must prioritize the update to the patched versions listed above to eliminate the injection vector. If immediate patching is prevented by development cycles, rigorous input validation and the implementation of direct process invocation are required to mitigate the risk of remote code execution.