A high-severity argument-injection vulnerability in the CliInvoke .NET library can lead to arbitrary command execution on systems using the affected component.

This is an argument-injection vulnerability (CWE-88) occurring within the RunnerProcessFactory and RunnerConfigurationFactory classes. The library improperly handles user-controlled input when constructing command-line arguments, allowing an attacker to escape quoted regions and inject malicious commands, which can be executed if a shell runner is invoked.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the underlying host with the privileges of the application process. Given the CVSS score of 8.4, this poses a significant risk of full system compromise, including unauthorized data access, modification of system files, and potential pivot points into the broader network environment.

Immediate Action: Update the CliInvoke library to version 2.8.5, 2.9.4, 2.10.5, or 3.0.0-beta.2, or update the AlastairLundy.CliInvoke package to version 2.0.2.

Proactive Monitoring: Monitor application logs for unusual command-line executions or unexpected child processes spawned by the application.

Compensating Controls: If immediate patching is not feasible, developers should avoid passing untrusted input directly into the factory methods and instead construct ProcessConfiguration objects using an explicit ArgumentList to avoid shell interpretation issues.

Public Exploit Available: Unknown

Organizations utilizing the CliInvoke library must prioritize upgrading to the specified patched versions to eliminate this injection vector. Due to the potential for arbitrary code execution, this update should be treated as a critical maintenance task to prevent unauthorized system access.