CVE-2026-16630

syncfusion ej2-javascript-ui-controls package.json child_process.exec os command injection

4.8 Medium

CVE-2026-16630 is a medium vulnerability (CVSS 4.8) in Syncfusion Ej2-javascript-ui-controls, published July 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. No source names a fixed version.

A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function child_process.exec of the file package.json. The manipulation leads to os command injection. An attack has to be approached locally. The exploit has been disclosed publicly and may be used.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

1.08%Unchanged since Jul 23, 2026

What each source reports

CVE List Score used 4.8

syncfusion ej2-javascript-ui-controls package.json child_process.exec os command injection

Record: CVE-2026-16630
CVSS 4.0: 4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CVSS 2.0: 4.3 AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
Weakness: CWE-78, CWE-77
Updated: 2026-11-02

EUVDEUVD-2026-47862 4.8

Record: EUVD-2026-47862
CVSS 4.0: 4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-8vqr-xp4f-pr6m 1.9

A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3....

Record: GHSA-8vqr-xp4f-pr6m
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-77
Updated: 2026-11-02

NVD 1.9

Record: CVE-2026-16630
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0: 4.3 MediumAV:L/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-77, CWE-78
Updated: 2026-11-02

OSV 1.9