EUVD-2026-53335
GHSA-72rr-952g-697v
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local attack vector and required user interaction are accurate for a CLI tool; no privileges needed to invoke the CLI, and full system impact is plausible via arbitrary command execution.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
3DescriptionCVE.org
@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name.
AnalysisAI
OS command injection in @oblique/cli 15.4.0 allows arbitrary shell command execution on the local system when a developer invokes the project-creation feature with a crafted project name. The CLI passes user-supplied input directly into shell commands via string concatenation before calling Node.js execSync(), meaning shell metacharacters (semicolons, backticks, pipes) in the project-name argument are interpreted by the OS shell. The attack is limited to local execution contexts - an attacker must either control the project name passed to the CLI or socially engineer a developer into supplying a malicious string. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor patch (>=15.4.2) is available.
Technical ContextAI
The @oblique/cli is a Node.js command-line scaffold tool maintained by the Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT), part of the Oblique design system for Angular applications. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) identifies the root cause: user-controlled input is concatenated into a shell command string and passed to Node.js's child_process.execSync(), which invokes a system shell (e.g., /bin/sh) to execute it. Without proper escaping or use of argument array forms of execSync(), shell metacharacters embedded in the project-name parameter are parsed and executed by the shell as separate commands. CPE cpe:2.3:a:swiss_federal_office_of_information_technology,_systems_and_telecommunication:@oblique/cli:*:*:*:*:*:*:*:* confirms the affected package is the FOITT-maintained CLI. Versions from 15.4.0 up to (not including) 15.4.2 are affected per EUVD-2026-53335.
RemediationAI
Upgrade @oblique/cli to version 15.4.2 or later, which resolves the command injection by neutralizing user-controlled input before shell execution. Run 'npm install -g @oblique/cli@latest' or update the package in your project's devDependencies. The fix details and changelog are documented at https://github.com/oblique-bit/oblique/blob/master/projects/cli/CHANGELOG.md. As a compensating control prior to patching, restrict the project-name input to alphanumeric characters and hyphens only (allowlist validation) before passing to the CLI, or avoid automated/scripted invocations of the CLI with externally-sourced project names. If the CLI is used in CI/CD pipelines, ensure pipeline inputs are sanitized and sourced only from trusted, controlled systems - blocking pipeline access to untrusted external name sources reduces exposure without disabling the tool entirely.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today