Oblique Cli
Monthly
OS command injection in @oblique/cli 15.4.0 allows arbitrary shell command execution on the local system when a developer invokes the project-creation feature with a crafted project name. The CLI passes user-supplied input directly into shell commands via string concatenation before calling Node.js execSync(), meaning shell metacharacters (semicolons, backticks, pipes) in the project-name argument are interpreted by the OS shell. The attack is limited to local execution contexts - an attacker must either control the project name passed to the CLI or socially engineer a developer into supplying a malicious string. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor patch (>=15.4.2) is available.
OS command injection in @oblique/cli 15.4.0 allows arbitrary shell command execution on the local system when a developer invokes the project-creation feature with a crafted project name. The CLI passes user-supplied input directly into shell commands via string concatenation before calling Node.js execSync(), meaning shell metacharacters (semicolons, backticks, pipes) in the project-name argument are interpreted by the OS shell. The attack is limited to local execution contexts - an attacker must either control the project name passed to the CLI or socially engineer a developer into supplying a malicious string. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor patch (>=15.4.2) is available.