CVE-2026-16022
Received Received - Intake

OS Command Injection in @oblique/cli Project Creation

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Switzerland Government Common Vulnerability Program

Description
@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-16022
EUVD
EUVD-2026-53335

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
oblique cli 15.4.0
oblique cli to 15.4.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-16022 is an OS command injection vulnerability in @oblique/cli version 15.4.0. The CLI builds shell commands by combining strings and executes them using execSync(). A user-controlled project name is inserted into the command without proper sanitization, allowing shell metacharacters to run additional OS commands when the CLI is used with a specially crafted project name.

Detection Guidance

Check the installed version of oblique CLI with 'npm list -g @oblique/cli' or 'oblique --version'. If it is below 15.4.2, the system is vulnerable. Review project creation logs for suspicious commands or unexpected behavior when using the CLI.

Impact Analysis

If you use @oblique/cli 15.4.0, an attacker could trick you into running malicious commands on your system by providing a malicious project name. This could lead to unauthorized code execution, data theft, or system compromise depending on the attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized command execution on the host system, potentially compromising sensitive data. For GDPR, it may result in unauthorized access to personal data, violating principles of data protection and user consent. For HIPAA, it could allow unauthorized access to protected health information, breaching confidentiality requirements.

Mitigation Strategies

Upgrade to oblique CLI version 15.4.2 or later immediately. Avoid using the CLI with untrusted project names until patched. Monitor system logs for unusual command execution patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16022. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart