The vulnerability in publint up to version 0.1.4 involves OS command injection via the child_process.exec function in src/node/pack.js within the package-manager Command Handler component. This allows a local attacker with low privileges to execute arbitrary OS commands due to insufficient input sanitization. The vulnerability has a CVSS 4.8 (medium) score, indicating moderate impact. A patch has been identified (commit adf2d9a09945fc98c85a2520a89f441d78b2dbd8) to address this issue. The exploit code is publicly available, but exploitation requires local access. The project maintainer suggests the risk is limited because the package is rarely used with untrusted input.

Successful exploitation allows a local attacker with low privileges to execute arbitrary operating system commands on the affected system. This can lead to unauthorized command execution within the context of the user running publint. The impact is limited by the requirement for local access and the low likelihood of untrusted input usage, resulting in a medium severity rating (CVSS 4.8).

A patch addressing this vulnerability is available, identified by commit adf2d9a09945fc98c85a2520a89f441d78b2dbd8. It is strongly recommended to apply this patch to all affected versions (0.1.0 through 0.1.4) to remediate the issue. Additionally, avoid using publint with untrusted input to reduce risk. No official vendor advisory or automated patch distribution is indicated, so manual patching is required.