CVE-2026-16022

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/oblique-bit/oblique/blob/master/projects/cli/CHANGELOG.md

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) @oblique/cli 15.4.0 contiene una vulnerabilidad de inyección de comandos del sistema operativo en la funcionalidad de creación de proyectos. La CLI construye comandos de shell mediante concatenación de cadenas y los ejecuta con execSync(). Un argumento project-name controlado por el usuario se inserta en el comando de shell sin la neutralización adecuada, permitiendo que los metacaracteres de shell ejecuten comandos adicionales del sistema operativo cuando la CLI es invocada con un nombre de proyecto manipulado.

Information

Published : 2026-08-05 13:20

Updated : 2026-10-23 21:10

NVD link : CVE-2026-16022

Mitre link : CVE-2026-16022

CVE.ORG link : CVE-2026-16022

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-16022", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16022", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T15:28:28.560867Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "vulnerability@ncsc.ch", "affectedData": [{"vendor": "Swiss Federal Office of Information Technology, Systems and Telecommunication", "product": "@oblique/cli", "versions": [{"status": "affected", "version": "15.4.0", "lessThan": "15.4.2", "versionType": "semver"}], "platforms": ["Linux", "macOS", "Windows"], "defaultStatus": "unknown"}]}], "published": "2026-08-05T13:20:39.450", "references": [{"url": "https://github.com/oblique-bit/oblique/blob/master/projects/cli/CHANGELOG.md", "source": "vulnerability@ncsc.ch"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name."}, {"lang": "es", "value": "@oblique/cli 15.4.0 contiene una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en la funcionalidad de creaci\u00f3n de proyectos. La CLI construye comandos de shell mediante concatenaci\u00f3n de cadenas y los ejecuta con execSync(). Un argumento project-name controlado por el usuario se inserta en el comando de shell sin la neutralizaci\u00f3n adecuada, permitiendo que los metacaracteres de shell ejecuten comandos adicionales del sistema operativo cuando la CLI es invocada con un nombre de proyecto manipulado."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "vulnerability@ncsc.ch"}