CVE-2026-16733: OS Command Injection in bahmutov find-cypress-specs
A command injection vulnerability exists in bahmutov find-cypress-specs up to version 1.54.12. The issue is in the shell.exec function within src/index.js, specifically when handling the --branch argument. This vulnerability allows local attackers with limited privileges to execute arbitrary OS commands. The vulnerability has a medium severity score of 4.8 and is publicly known, but no official fix or patch has been released yet.
AI Analysis
Technical Summary
CVE-2026-16733 describes an OS command injection vulnerability in the bahmutov find-cypress-specs project affecting versions 1.54.0 through 1.54.12. The flaw resides in the shell.exec function of src/index.js in the Branch Handler component, where improper handling of the --branch argument enables injection of arbitrary operating system commands. Exploitation requires local access with low privileges and does not require user interaction. The vulnerability has been publicly disclosed, but the vendor has not yet provided a response or patch.
Potential Impact
An attacker with local access and low privileges can exploit this vulnerability to execute arbitrary OS commands on the affected system. This could lead to unauthorized actions depending on the privileges of the executing process. However, the attack surface is limited to local execution, reducing the risk of remote exploitation.
Mitigation Recommendations
No official fix or patch is currently available from the vendor. Users should avoid running the vulnerable versions locally with untrusted input for the --branch argument. Monitor vendor communications for updates and patches addressing this vulnerability.
CVE-2026-16733: OS Command Injection in bahmutov find-cypress-specs
Description
A command injection vulnerability exists in bahmutov find-cypress-specs up to version 1.54.12. The issue is in the shell.exec function within src/index.js, specifically when handling the --branch argument. This vulnerability allows local attackers with limited privileges to execute arbitrary OS commands. The vulnerability has a medium severity score of 4.8 and is publicly known, but no official fix or patch has been released yet.
CVSS v4.0
Score 4.8medium
Affected software
cpe:2.3:a:bahmutov:find-cypress-specs:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-16733 describes an OS command injection vulnerability in the bahmutov find-cypress-specs project affecting versions 1.54.0 through 1.54.12. The flaw resides in the shell.exec function of src/index.js in the Branch Handler component, where improper handling of the --branch argument enables injection of arbitrary operating system commands. Exploitation requires local access with low privileges and does not require user interaction. The vulnerability has been publicly disclosed, but the vendor has not yet provided a response or patch.
Potential Impact
An attacker with local access and low privileges can exploit this vulnerability to execute arbitrary OS commands on the affected system. This could lead to unauthorized actions depending on the privileges of the executing process. However, the attack surface is limited to local execution, reducing the risk of remote exploitation.
Mitigation Recommendations
No official fix or patch is currently available from the vendor. Users should avoid running the vulnerable versions locally with untrusted input for the --branch argument. Monitor vendor communications for updates and patches addressing this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-07-23T07:36:57.392Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a62204b9c2644c7f82e70de
Added to database: 07/23/2026, 14:08:11 UTC
Last enriched: 07/23/2026, 14:22:53 UTC
Last updated: 07/23/2026, 14:22:53 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.