GHSA-j73w-8hfr-4gc9 CliInvoke: Argument Injection in Extensibility Runner Factory

• NuGet CliInvoke: >= 2.0.0, < 2.8.5 → fixed in 2.8.5 • NuGet CliInvoke: >= 2.9.0, < 2.9.4 → fixed in 2.9.4 • NuGet CliInvoke: >= 2.10.0, < 2.10.5 → fixed in 2.10.5 • NuGet CliInvoke: >= 3.0.0-alpha.1, < 3.0.0-beta.2 → fixed in 3.0.0-beta.2 • NuGet AlastairLundy.CliInvoke: >= 2.0.0-alpha.1, < 2.0.2 → fixed in 2.0.2

Impact An argument-injection vulnerability exists in the `CliInvoke` package's runner factory: `RunnerProcessFactory` on the 2.x line and `RunnerConfigurationFactory` on the 3.x line. The factory joins the runner arguments, the caller's target, and the caller's arguments into a single `ProcessStartInfo.Arguments` string and hands it to the OS. The OS command-line parser re-tokenizes the string before the runner sees it. A double quote (`"`) in the target or in any argument closes the OS-level quoted region and lets the next character enter argv as a separate element. Patches Upgrade to: • 2.8.5 (2.8.x line) • 2.9.4 (2.9.x line) • 2.10.5 (2.10.x line) • 3.0.0-beta.2 (3.x pre-release line) Workarounds No complete workaround is available. Until you can upgrade: • Strip `"` from any target or argument before passing it to the factory. On shell runners, also strip `;`, `|`, `&`, `$`, backtick, and parentheses. • Or bypass the factory entirely and build the `ProcessConfiguration` directly. Set `ArgumentList` explicitly to the argv you want the runner to receive. These are partial mitigations. They shift the quoting problem to your code.