CVE-2026-16022

{
  "id": "CVE-2026-16022",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-05T13:20:39.450",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name."
    },
    {
      "lang": "es",
      "value": "@oblique/cli 15.4.0 contiene una vulnerabilidad de inyección de comandos del sistema operativo en la funcionalidad de creación de proyectos. La CLI construye comandos de shell mediante concatenación de cadenas y los ejecuta con execSync(). Un argumento project-name controlado por el usuario se inserta en el comando de shell sin la neutralización adecuada, permitiendo que los metacaracteres de shell ejecuten comandos adicionales del sistema operativo cuando la CLI es invocada con un nombre de proyecto manipulado."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Swiss Federal Office of Information Technology, Systems and Telecommunication",
          "product": "@oblique/cli",
          "defaultStatus": "unknown",
          "platforms": [
            "Linux",
            "macOS",
            "Windows"
          ],
          "versions": [
            {
              "version": "15.4.0",
              "lessThan": "15.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T15:28:28.560867Z",
          "id": "CVE-2026-16022",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/oblique-bit/oblique/blob/master/projects/cli/CHANGELOG.md",
      "source": "[email protected]"
    }
  ]
}