CVE-2026-16022: Swiss Federal Office of Information Technology

Описание

Оригинално описание

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name.

Засегнати продукти

• Swiss Federal Office of Information Technology, Systems and Telecommunication @oblique/cli: 15.4.0 преди 15.4.2

Вид слабост

• CWE-78 Инжектиране на команди към операционната система

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-16022
• https://nvd.nist.gov/vuln/detail/CVE-2026-16022
• https://github.com/oblique-bit/oblique/blob/master/projects/cli/CHANGELOG.md