CVE-2026-16022: Command Injection in @oblique/cli
@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16022?
CVE-2026-16022 has a high severity rating of 7.8.
How do I fix CVE-2026-16022?
To fix CVE-2026-16022, update @oblique/cli to version 15.4.1 or later to address the command injection vulnerability.
What type of vulnerability is CVE-2026-16022?
CVE-2026-16022 is classified as an OS command injection vulnerability.
What versions of @oblique/cli are affected by CVE-2026-16022?
The vulnerability affects @oblique/cli version 15.4.0.
What impact does CVE-2026-16022 have on the system?
CVE-2026-16022 can lead to remote command execution due to improper handling of user-controlled input.