CVE-2026-16628: oclif Command Injection RCE Vulnerability

CVE-2026-16628 Overview

CVE-2026-16628 is an operating system (OS) command injection vulnerability in the oclif command-line framework, affecting versions up to 4.23.16. The flaw resides in the Just-in-Time (JIT) Plugin Entry Handler, where the jitPlugins argument is passed unsanitized to child_process.exec. An attacker with local access can manipulate this input to execute arbitrary operating system commands in the context of the process invoking oclif. A public exploit exists, and the maintainers issued a patch tracked by commit hash 939b045725e065baebc4587b8bccfd56731eed3d. The weakness is classified under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact
Local attackers can inject shell metacharacters into the jitPlugins argument, achieving arbitrary OS command execution through the vulnerable exec call in the JIT plugin manifest command.

Affected Products

oclif framework versions up to and including 4.23.16
The src/commands/manifest.ts component containing the JIT Plugin Entry Handler
Node.js command-line applications built on affected oclif releases

Discovery Timeline

2026-07-22 - CVE-2026-16628 published to the National Vulnerability Database (NVD)
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16628

Vulnerability Analysis

The vulnerability originates in the oclif manifest command, which handles Just-in-Time plugin installation. The handler builds a shell command string incorporating the jitPlugins argument and dispatches it through Node.js child_process.exec. Because exec spawns a shell (/bin/sh -c or cmd.exe /c), any shell metacharacter present in jitPlugins — such as ;, &&, |, or backticks — is interpreted by the shell rather than treated as a literal argument.

Exploitation requires local access and low privileges, meaning an attacker who can influence the arguments passed to an oclif-based CLI tool (for example, through a wrapper script, CI pipeline configuration, or a shared build environment) can chain arbitrary commands. Impact is limited to the executing user's privilege scope, but in continuous integration (CI) or developer workstation contexts, this can extend to source code, credentials, or build artifacts.

Root Cause

The root cause is the use of child_process.exec with a command string built from untrusted input. exec performs no argument separation and delegates parsing to the underlying shell, making it structurally unsafe for user-controlled data. The fix replaces exec with spawn, which accepts arguments as a discrete array and does not invoke a shell by default.

Attack Vector

An attacker supplies a crafted plugin identifier through the jitPlugins argument path. Shell metacharacters embedded in the identifier break out of the intended command context and execute attacker-chosen commands. The attack requires local invocation of the vulnerable oclif command.

typescript

// Security patch in src/commands/manifest.ts
// fix: prevent command injection by jit plugins @W-23028384@

 import {Args, Command, Flags, Interfaces, Plugin, ux} from '@oclif/core'
 import {access, mkdir, readJSON, readJSONSync, remove, unlinkSync, writeFileSync} from 'fs-extra'
-import {exec, ExecOptions} from 'node:child_process'
+import {spawn, SpawnOptions} from 'node:child_process'
 import * as os from 'node:os'
 import path from 'node:path'

Source: oclif commit 939b045. The patch migrates from exec (shell-based, string command) to spawn (argument array, no shell), eliminating the injection primitive.

Detection Methods for CVE-2026-16628

Indicators of Compromise

Unexpected child processes spawned by Node.js processes running oclif-based CLI tools, particularly /bin/sh -c invocations with concatenated commands.
Shell metacharacters (;, &&, ||, |, `, $()) present in command-line arguments to oclif manifest invocations.
Outbound network connections initiated from short-lived child processes of CLI build tools during plugin installation.

Detection Strategies

Audit installed oclif versions across developer workstations and CI runners; flag any instance at or below 4.23.16.
Instrument process creation logging (Sysmon Event ID 1 on Windows, execve auditing via auditd on Linux) to capture full command lines for Node.js child processes.
Static-scan JavaScript and TypeScript projects for imports of oclif and pinned versions in package.json and lockfiles.

Monitoring Recommendations

Monitor CI/CD pipelines for anomalous shell activity spawned from plugin manifest generation steps.
Correlate parent-child process telemetry to surface Node.js processes launching unexpected shells or interpreters.
Track file writes to sensitive locations (SSH keys, credential stores, .npmrc) originating from oclif-based tool executions.

How to Mitigate CVE-2026-16628

Immediate Actions Required

Upgrade oclif to a version containing commit 939b045725e065baebc4587b8bccfd56731eed3d or later across all developer workstations, build agents, and CI/CD systems.
Inventory internal CLI tools built on oclif and rebuild them against the patched framework version.
Restrict who can supply jitPlugins values in shared automation and pipeline definitions until patching is complete.

Patch Information

The upstream fix is available in the oclif repository via commit 939b045725e065baebc4587b8bccfd56731eed3d. Additional context is available in GitHub Issue #2051 and Pull Request #2052. The remediation replaces child_process.exec with child_process.spawn, passing arguments as an array to avoid shell interpretation.

Workarounds

Avoid invoking the vulnerable oclif manifest command with externally influenced jitPlugins values until the patched release is deployed.
Enforce strict allow-lists for plugin identifiers in wrapper scripts, rejecting any input containing shell metacharacters.
Run oclif-based CLI tools under least-privilege service accounts to constrain the blast radius of successful injection.

bash

# Verify installed oclif version and upgrade to patched release
npm ls oclif
npm install oclif@latest --save-dev

# Confirm the patched commit is present in node_modules
grep -R "spawn, SpawnOptions" node_modules/oclif/lib/commands/manifest.js