What’s Vulnerable › Vulnerabilities

CVE-2026-16631: publint package-manager pack.js child_process.exec os command injection

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-23 · updated 2026-07-23
• Weakness: CWE-77

Description

A vulnerability was detected in publint up to 0.1.4. This impacts the function child_process.exec of the file src/node/pack.js of the component package-manager Command Handler. The manipulation results in os command injection. Attacking locally is a requirement. The exploit is now public and may be used. The patch is identified as adf2d9a09945fc98c85a2520a89f441d78b2dbd8. It is advisable to implement a patch to correct this issue. The project maintainer explains: "I think it's very rare for someone to use this package with untrusted input".

Affected products

• publint: 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4

References

• https://github.com/publint/publint/
• https://github.com/publint/publint/commit/adf2d9a09945fc98c85a2520a89f441d78b2dbd8
• https://github.com/publint/publint/issues/236
• https://github.com/publint/publint/pull/238
• https://vuldb.com/cve/CVE-2026-16631
• https://vuldb.com/submit/860239
• https://vuldb.com/vuln/382381
• https://vuldb.com/vuln/382381/cti

Get alerted when CVE-2026-16631 or the next vulnerability affects your stack