CVE-2026-16022

Name of the Vulnerable Software and Affected Versions @oblique/cli version 15.4.0

Description An OS command injection issue exists in the project creation functionality. The application constructs shell commands using string concatenation and executes them via the execSync() function. Because the project-name argument is inserted into the command without proper neutralization, an attacker can use shell metacharacters to execute arbitrary operating-system commands when the CLI is invoked with a specially crafted project name.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.