Junglewise Threat Intelligence

CVE-2026-16631: publint OS command injection in package-manager Command Handler

CVE-2026-16631 · Severity: medium · CVSS 5.3 · Published 2026-07-23

Executive brief

publint, a tool used to check for packaging errors in JavaScript projects, is vulnerable to a security flaw where it improperly handles file paths. If the tool is used to process a specially crafted file path provided by a local user, it could allow that user to execute unauthorized commands on the system. This could lead to a full system compromise or unauthorized data access depending on the permissions of the user running the tool.

Technical details

An OS command injection vulnerability exists in publint versions up to 0.1.4 within the `@publint/pack` component. The root cause is the insecure use of `child_process.exec()` in `src/node/pack.js`, where the `destination` and `packageManager` options are directly interpolated into a shell command string without proper sanitization or escaping. A local attacker can exploit this by providing a crafted destination path containing shell command substitutions (e.g., `$(command)`). The vulnerability was addressed in commit `adf2d9a` by migrating to `execFile` and implementing proper command interpolation to avoid shell evaluation of arguments.

Affected products

  • publint publint up to 0.1.4

Timeline

  • 2026-06-16: disclosed: Issue reported on GitHub
  • 2026-06-17: patched: Fix merged in PR #238
  • 2026-07-23: advisory: NVD publication date

References