CyberRota Analysis
AI-GeneratedThe vulnerability exists in the project creation functionality of @oblique/cli version 15.4.0, where improper handling of user-controlled input allows for OS command injection via shell command construction. This can lead to unauthorized execution of arbitrary commands on the host system, posing a significant security risk. Organizations utilizing this CLI tool should prioritize remediation to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name.