EUVD-2026-47832
GHSA-h75p-gxr9-842c
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack via controlled config file requiring filesystem write access (PR:L, AV:L); no scope change, limited confidentiality, integrity, and availability impact matching CVSS 4.0 baseline.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function child_process.exec of the component JIT Plugin Entry Handler. Performing a manipulation of the argument jitPlugins results in os command injection. The attack is only possible with local access. The exploit is now public and may be used. The patch is named 939b045725e065baebc4587b8bccfd56731eed3d. To fix this issue, it is recommended to deploy a patch.
AnalysisAI
OS command injection in oclif up to 4.23.16 allows a local attacker who can control the jitPlugins configuration to execute arbitrary shell commands through the JIT Plugin Entry Handler's unsafe use of child_process.exec. The root cause is that plugin names from the oclif.jitPlugins field in package.json are interpolated directly into shell command strings passed to exec(), enabling shell metacharacter injection. A public exploit exists (GitHub issue #2051) and a patch has been released replacing exec() with cross-spawn's argument-array-based spawn().
Technical ContextAI
oclif is the Open CLI Framework maintained by Salesforce for building Node.js command-line interfaces. The affected component is the manifest command's executeCommand helper (src/commands/manifest.ts), which used Node.js's child_process.exec() to run npm pack and tar commands. exec() passes its first argument to the OS shell as a single string, making it vulnerable to shell injection when unsanitized user-controlled data is interpolated into the command string. Specifically, jitPlugin keys from package.json (the oclif.jitPlugins map) were embedded directly into the shell string without escaping. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) is the root cause class. The fix (commit 939b045725e065baebc4587b8bccfd56731eed3d, PR #2052) replaces exec() with cross-spawn's spawn() and passes all arguments as a discrete string array, bypassing shell interpretation entirely. Affected CPE: cpe:2.3:a:n/a:oclif:*:*:*:*:*:*:*:* up to version 4.23.16.
RemediationAI
The upstream fix is available as commit 939b045725e065baebc4587b8bccfd56731eed3d on GitHub (https://github.com/oclif/oclif/commit/939b045725e065baebc4587b8bccfd56731eed3d) via PR #2052; however, a specific released npm package version number is not independently confirmed from the available data - verify the fixed version on the oclif npm registry page before upgrading. The fix replaces child_process.exec() with cross-spawn's spawn() and argument arrays, eliminating shell interpolation of plugin names. As a compensating control where upgrading is not immediately possible, restrict write access to any package.json files consumed by oclif manifest to trusted principals only, and audit existing oclif.jitPlugins keys for shell metacharacters (semicolons, backticks, pipe characters, dollar signs). Do not run oclif manifest against untrusted or externally sourced package.json files. CI pipelines that invoke oclif manifest on developer-supplied configs are at elevated risk until patched.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today