OS Command Injection Vulnerability in @oblique/cli Affected by Improper Input Handling
CVE-2026-16022

7.8HIGH

Key Information:

Vendor

Swiss Federal Office Of Information Technology, Systems And Telecommunication

Status
@oblique/cli
Vendor
CVE Published:
5 August 2026

What is CVE-2026-16022?

The @oblique/cli version 15.4.0 is susceptible to OS command injection due to improper handling of user input in the project creation feature. By concatenating user-controlled input, specifically the project-name, into shell commands without adequate escape mechanisms, the CLI can inadvertently execute arbitrary operating-system commands. This can occur when an attacker provides a specially crafted project name during the command invocation.

Affected Version(s)

@oblique/cli Linux 15.4.0 < 15.4.2

References

https://github.com/oblique-bit/oblique/blob/master/projec...
release-notes

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonas Friedli
.