EUVD-2026-48283
GHSA-wmpm-jc79-f6jv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack requiring low privileges to manipulate infile config; limited confidentiality, integrity, and availability impact; no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
OS command injection in the release-it conventional-changelog plugin (up to v11.0.1) allows a local low-privileged user to execute arbitrary operating system commands by supplying a crafted value for the infile argument to the writeChangelog function in index.js. The vulnerability has been publicly disclosed through a GitHub issue report, and exploit code is available. No patch has been released at time of analysis, as the project maintainer had not responded to the responsible disclosure.
Technical ContextAI
The affected component is the @release-it/conventional-changelog plugin, a Node.js package that automates CHANGELOG generation during software release workflows, typically invoked via the release-it CLI toolchain. The vulnerable function writeChangelog in index.js constructs or passes an OS-level command incorporating the infile argument - a file path designating the changelog destination - without adequately neutralizing shell metacharacters. CWE-77 (Improper Neutralization of Special Elements used in a Command) describes this root cause class: when user-controllable input is concatenated into a command string executed by the OS shell rather than using parameterized calls, an attacker can break out of the intended command context using characters such as semicolons, pipes, backticks, or dollar-sign subshells. This class of flaw is distinct from CWE-78 (OS Command Injection via shell) only in the injection mechanism; the impact is equivalent. The attack surface is the local execution environment - developer workstations, CI/CD runners, or shared build servers - wherever release-it is invoked.
RemediationAI
No vendor-released patch has been identified at time of analysis. The maintainer had not responded to the responsible disclosure via GitHub issue #149 (https://github.com/release-it/conventional-changelog/issues/149) as of reporting. As an immediate compensating control, audit all invocations of writeChangelog and ensure the infile argument is derived exclusively from trusted, hardcoded configuration rather than any user-supplied or environment-derived input - this eliminates the injection surface without requiring a code change. In CI/CD pipelines, restrict write access to release-it configuration files (.release-it.json, .release-it.yml) to reduce the risk of a compromised actor injecting a malicious infile value. Consider pinning to the current version and monitoring the upstream repository (https://github.com/release-it/conventional-changelog/) for a patched release; once available, upgrade immediately. Organizations with high sensitivity to supply-chain risk may consider temporarily replacing this plugin with a trusted alternative changelog generator until the maintainer addresses the issue. Restricting execution of release workflows to isolated, single-purpose CI environments limits the blast radius if exploitation occurs.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today