Executive brief
oclif is a framework used by developers to build command-line interfaces (CLIs). A security flaw in its plugin handling system allows a local attacker to execute unauthorized commands on a user's computer. This could lead to a full system compromise if a user runs a CLI tool built with a vulnerable version of oclif that processes a malicious configuration file.
Technical details
An OS command injection vulnerability exists in oclif versions up to 4.23.16 within the JIT Plugin Entry Handler. The vulnerability is rooted in the use of the 'child_process.exec' function, which insecurely handles the 'jitPlugins' argument from 'package.json'. By manipulating this argument, a local attacker can inject shell commands that are executed by the underlying operating system. The fix involves migrating from 'child_process.exec' to 'child_process.spawn' to properly handle command arguments and prevent shell interpretation. A patch has been released in commit 939b045725e065baebc4587b8bccfd56731eed3d.
Affected products
- oclif oclif up to 4.23.16
Timeline
- 2026-06-18: other: Fix developed and pull request opened
- 2026-06-22: patched: Fix merged into main branch
- 2026-07-22: disclosed: Vulnerability published and CVE assigned