CVE-2026-16733
Received Received - Intake

Command Injection in find-cypress-specs

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulDB

Description
A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-16733
EUVD
EUVD-2026-48281

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bahmutov find-cypress-specs to 1.54.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-16733 is a command injection vulnerability in the find-cypress-specs tool up to version 1.54.12. The issue occurs in the Branch Handler component where the --branch parameter is passed unsanitized to shell.exec() in src/index.js. Attackers can inject shell metacharacters like semicolons or dollar signs into branch names to execute arbitrary commands.

Detection Guidance

Check if the vulnerable version (1.54.12 or earlier) of find-cypress-specs is installed by running: npm list find-cypress-specs. If installed, inspect command usage in CI logs for suspicious branch names containing shell metacharacters like semicolons or dollar signs.

Impact Analysis

This vulnerability allows attackers with access to branch names or environment variables to execute arbitrary commands on the system running the tool. It is particularly dangerous in CI environments where branch names can be influenced by attackers. The attack is limited to local execution.

Mitigation Strategies

Upgrade to a patched version of find-cypress-specs if available. Avoid passing untrusted branch names to the tool. Use safer child_process methods like execFile or spawn with argument arrays instead of shell.exec. Validate branch names as Git refnames before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16733. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart