publint CVE-2026-16631

publint is a Node.js npm package linting tool; its @publint/pack sub-package orchestrates invocations of package managers (npm, yarn, pnpm, bun) to produce pack outputs. The vulnerability (CWE-77: Command Injection) arises because pack.js and pack-as-json.js build the shell command via string interpolation - e.g., let command = \${packageManager} pack\`` - and execute it through Node.js's child_process.exec, which spawns a shell that interprets metacharacters. If the packageManager value contains shell metacharacters such as semicolons or pipes, the shell interprets them as command delimiters and executes the injected payload. The fix replaces child_process.exec string-based invocation with the tinyexec library using argument arrays (exec(command[0], command.slice(1), ...)), which bypasses shell interpretation entirely, and adds an allowlist validation restricting packageManager to the set ['npm', 'yarn', 'pnpm', 'bun']. No CPE strings are provided in source data; the package is an npm module for Node.js developer environments.