CVE-2026-16733

A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS v3 5.3 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 3.1 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/bahmutov/find-cypress-specs/
https://github.com/bahmutov/find-cypress-specs/issues/423
https://vuldb.com/cve/CVE-2026-16733
https://vuldb.com/submit/861021
https://vuldb.com/vuln/382478
https://vuldb.com/vuln/382478/cti

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Se ha identificado una debilidad en bahmutov find-cypress-specs hasta la versión 1.54.12. El elemento afectado es la función shell.exec del archivo src/index.js del componente Gestor de Ramas. Esta manipulación del argumento --branch causa inyección de comandos del sistema operativo. El ataque está restringido a la ejecución local. El exploit ha sido puesto a disposición del público y podría ser utilizado para ataques. El proyecto fue notificado del problema tempranamente a través de un informe de incidencias, pero aún no ha respondido.

Information

Published : 2026-07-23 14:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-16733

Mitre link : CVE-2026-16733

CVE.ORG link : CVE-2026-16733

JSON object : View

Products Affected

No product.

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-16733", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16733", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T15:38:03.744687Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:bahmutov:find-cypress-specs:*:*:*:*:*:*:*:*"], "vendor": "bahmutov", "modules": ["Branch Handler"], "product": "find-cypress-specs", "versions": [{"status": "affected", "version": "1.54.0"}, {"status": "affected", "version": "1.54.1"}, {"status": "affected", "version": "1.54.2"}, {"status": "affected", "version": "1.54.3"}, {"status": "affected", "version": "1.54.4"}, {"status": "affected", "version": "1.54.5"}, {"status": "affected", "version": "1.54.6"}, {"status": "affected", "version": "1.54.7"}, {"status": "affected", "version": "1.54.8"}, {"status": "affected", "version": "1.54.9"}, {"status": "affected", "version": "1.54.10"}, {"status": "affected", "version": "1.54.11"}, {"status": "affected", "version": "1.54.12"}]}]}], "published": "2026-07-23T14:17:08.660", "references": [{"url": "https://github.com/bahmutov/find-cypress-specs/", "source": "cna@vuldb.com"}, {"url": "https://github.com/bahmutov/find-cypress-specs/issues/423", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-16733", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/861021", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/382478", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/382478/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se ha identificado una debilidad en bahmutov find-cypress-specs hasta la versi\u00f3n 1.54.12. El elemento afectado es la funci\u00f3n shell.exec del archivo src/index.js del componente Gestor de Ramas. Esta manipulaci\u00f3n del argumento --branch causa inyecci\u00f3n de comandos del sistema operativo. El ataque est\u00e1 restringido a la ejecuci\u00f3n local. El exploit ha sido puesto a disposici\u00f3n del p\u00fablico y podr\u00eda ser utilizado para ataques. El proyecto fue notificado del problema tempranamente a trav\u00e9s de un informe de incidencias, pero a\u00fan no ha respondido."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "cna@vuldb.com"}