References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Change History

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI is invoked with a crafted project name.

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-78

https://github.com/oblique-bit/oblique/blob/master/projects/cli/CHANGELOG.md

[{"vendor":"Swiss Federal Office of Information Technology, Systems and Telecommunication","product":"@oblique/cli","defaultStatus":"unknown","platforms":["Linux","macOS","Windows"],"versions":[{"version":"15.4.0","lessThan":"15.4.2","versionType":"semver","status":"affected"}]}]