CVE-2026-16022 — Command Injection in @oblique/cli

Description (CNA)

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name.

Affected (CNA)

Vendor / product	Versions
Swiss Federal Office of Information Technology, Systems and Telecommunication / @oblique/cli	affected 15.4.0 before 15.4.2

CWE

CWE-78

References

https://github.com/oblique-bit/oblique/blob/master/projects/cli/CHANGELOG.md

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.