CVE-2026-16022 in cli
Summary
by MITRE • 08/05/2026
@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in @oblique/cli version 15.4.0 represents a critical operating system command injection flaw that stems from improper input validation and sanitization within the project creation workflow. This vulnerability resides in the core functionality that handles user-provided project names during CLI initialization, where the software employs string concatenation to build shell commands for execution. The flaw manifests when the application accepts user input through the project-name argument without implementing adequate neutralization measures, creating an environment where maliciously crafted inputs can be interpreted as shell commands rather than simple identifiers.
The technical implementation of this vulnerability follows a classic command injection pattern where the CLI utility constructs shell commands by concatenating user-provided strings directly into execution contexts. When execSync() is invoked with improperly sanitized input, any shell metacharacters present in the project name argument such as semicolons, pipes, or backticks can trigger unintended command execution. This occurs because the application fails to properly escape or quote user-supplied values before incorporating them into system calls, effectively allowing attackers to append arbitrary commands that execute with the privileges of the CLI process.
The operational impact of this vulnerability extends beyond simple privilege escalation as it enables attackers to potentially compromise entire systems through unauthorized command execution. An attacker could craft a malicious project name containing shell injection sequences that would execute commands such as deleting files, creating backdoors, accessing sensitive data, or even establishing persistent access mechanisms. The severity is amplified by the fact that this vulnerability affects the core project creation functionality, making it accessible to any user interacting with the CLI tool, including legitimate users who might unknowingly trigger the exploit through malformed input.
Security professionals should recognize this vulnerability as a direct instance of CWE-78 operating system command injection, which is categorized under the Common Weakness Enumeration framework for software security flaws. The attack vector aligns with techniques documented in the MITRE ATT&CK framework under the T1059.001 sub-technique for command and scripting interpreter, specifically targeting the execution of commands through shell interfaces. Organizations using this CLI tool face significant risk exposure since the vulnerability can be exploited remotely through any interface that invokes the affected functionality, potentially allowing attackers to execute arbitrary code on systems where the CLI is installed.
Mitigation strategies should focus on implementing proper input validation and sanitization mechanisms throughout the CLI's input processing pipeline. The most effective approach involves escaping or quoting all user-provided input before incorporating it into shell commands, utilizing parameterized command execution where possible, and avoiding direct string concatenation in execution contexts. Organizations should also consider implementing strict input filtering to reject potentially dangerous characters and employing principle of least privilege when running CLI processes to minimize the impact of successful exploitation attempts. Additionally, regular security updates and dependency audits should be conducted to ensure that all components remain free from similar injection vulnerabilities that could compromise system integrity.