EUVD-2026-76151Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Payload executes locally on developer or CI machine (AV:L); no OS privileges needed from attacker (PR:N); victim must invoke synthesis or task execution (UI:R); no scope change beyond the local system (S:U).
Primary rating from Vendor (ff89ba41-3aa1-4d27-914a-91399e9639e5).
CVSS VectorVendor: ff89ba41-3aa1-4d27-914a-91399e9639e5
Lifecycle Timeline
5DescriptionCVE.org
Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions.
To remediate this issue, users should upgrade to version 0.103.0 and then re-synthesize the project so that .projen/tasks.json is regenerated with the corrected task definitions. Upgrading alone is not sufficient because the generated task definition file is committed to the repository.
AnalysisAI
Command injection in projen's task synthesis component before version 0.103.0 allows context-dependent attackers to execute arbitrary commands on developer workstations or CI/CD runners. Shell metacharacters embedded in project configuration values or repository file names are interpolated unescaped into generated .projen/tasks.json task definitions, which execute when developers or automated pipelines invoke synthesized tasks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that an attacker can introduce shell metacharacters into project configuration values or repository file names that are processed during projen synthesis - for example, by submitting a pull request to a projen-managed repository, contributing to a shared project, or distributing a malicious projen project for others to clone and synthesize. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A, score 8.4) correctly characterizes this as a local-execution flaw: the payload does not traverse a network but instead detonates on the developer's or CI runner's machine when tasks are executed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade projen to version 0.103.0 or later via npm (npm install projen@0.103.0 or equivalent). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all projects using projen in your organization and restrict pull request acceptance to explicitly vetted contributors; audit recent changes to .projenrc and configuration files for suspicious modifications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today