CVE-2026-16631: OS Command Injection in publint
CVE-2026-16631 is an OS command injection vulnerability in the publint package-manager Command Handler affecting versions 0.1.0 through 0.1.4. The issue arises from unsafe use of child_process.exec in src/node/pack.js, allowing local attackers to execute arbitrary OS commands. The vulnerability requires local access and does not involve user interaction. A patch identified by commit adf2d9a09945fc98c85a2520a89f441d78b2dbd8 is available to fix the issue. The maintainer notes that usage with untrusted input is rare. The CVSS 4.8 score indicates medium severity.
AI Analysis
Technical Summary
The vulnerability in publint up to version 0.1.4 involves OS command injection via the child_process.exec function in the src/node/pack.js file within the package-manager Command Handler component. Local attackers with low privileges can exploit this by manipulating input to execute arbitrary OS commands. The vulnerability has a CVSS 4.8 (medium) score and requires local access without user interaction. A patch exists as identified by commit adf2d9a09945fc98c85a2520a89f441d78b2dbd8, and it is recommended to apply this patch to remediate the issue.
Potential Impact
Successful exploitation allows a local attacker to execute arbitrary operating system commands with the privileges of the vulnerable process. This could lead to unauthorized command execution on the affected system. However, exploitation requires local access and does not involve user interaction, limiting the attack surface. The vulnerability is rated medium severity with a CVSS score of 4.8.
Mitigation Recommendations
A patch identified by commit adf2d9a09945fc98c85a2520a89f441d78b2dbd8 is available and should be applied to correct this vulnerability. The project maintainer notes that the package is rarely used with untrusted input, which may reduce risk. No additional vendor advisory or official fix details are provided, so users should verify patch application from the project source repository.
CVE-2026-16631: OS Command Injection in publint
Description
CVE-2026-16631 is an OS command injection vulnerability in the publint package-manager Command Handler affecting versions 0.1.0 through 0.1.4. The issue arises from unsafe use of child_process.exec in src/node/pack.js, allowing local attackers to execute arbitrary OS commands. The vulnerability requires local access and does not involve user interaction. A patch identified by commit adf2d9a09945fc98c85a2520a89f441d78b2dbd8 is available to fix the issue. The maintainer notes that usage with untrusted input is rare. The CVSS 4.8 score indicates medium severity.
CVSS v4.0
Score 4.8medium
Affected software
cpe:2.3:a:publint:publint:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in publint up to version 0.1.4 involves OS command injection via the child_process.exec function in the src/node/pack.js file within the package-manager Command Handler component. Local attackers with low privileges can exploit this by manipulating input to execute arbitrary OS commands. The vulnerability has a CVSS 4.8 (medium) score and requires local access without user interaction. A patch exists as identified by commit adf2d9a09945fc98c85a2520a89f441d78b2dbd8, and it is recommended to apply this patch to remediate the issue.
Potential Impact
Successful exploitation allows a local attacker to execute arbitrary operating system commands with the privileges of the vulnerable process. This could lead to unauthorized command execution on the affected system. However, exploitation requires local access and does not involve user interaction, limiting the attack surface. The vulnerability is rated medium severity with a CVSS score of 4.8.
Mitigation Recommendations
A patch identified by commit adf2d9a09945fc98c85a2520a89f441d78b2dbd8 is available and should be applied to correct this vulnerability. The project maintainer notes that the package is rarely used with untrusted input, which may reduce risk. No additional vendor advisory or official fix details are provided, so users should verify patch application from the project source repository.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-07-22T16:08:22.735Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6157c79c2644c7f8e58595
Added to database: 07/22/2026, 23:52:39 UTC
Last enriched: 07/23/2026, 00:08:20 UTC
Last updated: 07/23/2026, 00:14:56 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.