CVE-2026-16735

Name of the Vulnerable Software and Affected Versions release-it conventional-changelog versions prior to 11.0.2

Description An OS command injection flaw exists in the Changelog File Handler component within the writeChangelog() function of the index.js file. A local attacker can exploit this by manipulating the infile argument to execute arbitrary operating system commands.

Recommendations Update release-it conventional-changelog to version 11.0.2 or later. As a temporary mitigation, restrict local access to the system to prevent unauthorized users from manipulating the infile argument.