{"id":"CVE-2026-16022","aliases":["EUVD-2026-53335","GHSA-72rr-952g-697v"],"status":"published","title":"Command Injection in @oblique/cli","description":"@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00817,"percentile":0.57443,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-08-05T12:06:19Z","modified":"2026-10-23T21:10:00Z","products":[{"vendor":"swiss federal office of information technology, systems and telecommunication","product":"@oblique/cli"}],"references":[{"url":"https://github.com/oblique-bit/oblique/blob/master/projects/cli/CHANGELOG.md","tags":["release-notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16022"},{"url":"https://github.com/advisories/GHSA-72rr-952g-697v"}],"sources":{"cve":[{"id":"CVE-2026-16022","title":"Command Injection in @oblique/cli","description":"@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name.","status":"published","published":"2026-08-05T12:06:19.814Z","modified":"2026-08-05T15:28:35.463Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:20:10.870108Z"}],"euvd":[{"id":"EUVD-2026-53335","description":"@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name.","status":"published","published":"2026-08-05T12:06:19Z","modified":"2026-08-05T15:28:35Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:09.87889Z"}],"ghsa":[{"id":"GHSA-72rr-952g-697v","title":"@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation...","description":"@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name.","status":"published","published":"2026-08-05T15:32:17Z","modified":"2026-08-05T15:32:18Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:10:06.632203Z"}],"nvd":[{"id":"CVE-2026-16022","description":"@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name.","status":"published","published":"2026-08-05T13:20:39.45Z","modified":"2026-10-23T21:10:00.157Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:35.031043Z"}]}}