CVE-2026-16631
Received Received - Intake

Command Injection in publint Package

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulDB

Description
A vulnerability was detected in publint up to 0.1.4. This impacts the function child_process.exec of the file src/node/pack.js of the component package-manager Command Handler. The manipulation results in os command injection. Attacking locally is a requirement. The exploit is now public and may be used. The patch is identified as adf2d9a09945fc98c85a2520a89f441d78b2dbd8. It is advisable to implement a patch to correct this issue. The project maintainer explains: "I think it's very rare for someone to use this package with untrusted input".

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-16631
EUVD
EUVD-2026-47863

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
publint publint to 0.1.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-16631 is a command injection vulnerability in the publint tool up to version 0.1.4. It affects the child_process.exec function in src/node/pack.js, allowing attackers to execute arbitrary commands locally by manipulating the destination or packageManager options. The vulnerability occurs because user-controlled input is passed directly into shell commands without proper sanitization.

Detection Guidance

To detect this vulnerability, check if your system uses publint versions up to 0.1.4. Inspect package.json for dependencies on @publint/pack and verify the version. If vulnerable, look for unusual command execution patterns in logs or process monitoring tools.

Impact Analysis

If you use publint with untrusted input, an attacker could execute arbitrary commands on your system with the same privileges as the Node.js process. This could lead to data theft, system compromise, or further network attacks. The vulnerability requires local access but could be exploited if publint processes malicious input.

Mitigation Strategies
  • Update publint to the latest version, which includes the patch for CVE-2026-16631.
  • Review and sanitize any user-controlled inputs passed to the destination or packageManager options in @publint/pack.
  • Replace child_process.exec with safer alternatives like child_process.execFile or tinyexec to prevent command injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16631. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart