Oclif
Monthly
OS command injection in oclif up to 4.23.16 allows a local attacker who can control the jitPlugins configuration to execute arbitrary shell commands through the JIT Plugin Entry Handler's unsafe use of child_process.exec. The root cause is that plugin names from the oclif.jitPlugins field in package.json are interpolated directly into shell command strings passed to exec(), enabling shell metacharacter injection. A public exploit exists (GitHub issue #2051) and a patch has been released replacing exec() with cross-spawn's argument-array-based spawn().
OS command injection in oclif up to 4.23.16 allows a local attacker who can control the jitPlugins configuration to execute arbitrary shell commands through the JIT Plugin Entry Handler's unsafe use of child_process.exec. The root cause is that plugin names from the oclif.jitPlugins field in package.json are interpolated directly into shell command strings passed to exec(), enabling shell metacharacter injection. A public exploit exists (GitHub issue #2051) and a patch has been released replacing exec() with cross-spawn's argument-array-based spawn().