CVE-2026-16022 PUBLISHED

Command Injection in @oblique/cli

Assigner: NCSC.ch
Reserved: 17.07.2026 Published: 05.08.2026 Updated: 05.08.2026

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 7.8

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Swiss Federal Office of Information Technology, Systems and Telecommunication
Product	@oblique/cli
Versions	Default: unknown affected from 15.4.0 to 15.4.2 (excl.)

Credits

Jonas Friedli finder

References

https://github.com/oblique-bit/oblique/blob/master/projects/cli/CHANGELOG.md

Problem Types

CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') CWE

Impacts

An attacker who can influence the project-name argument passed to @oblique/cli, or who can convince a developer to execute a crafted documented command, can execute arbitrary operating-system commands with the privileges of the user or CI/CD runner executing the CLI.