Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-16631: publint package manager allows command injection

CVE-2026-16631 · published 3 months ago

Summary

The publint tool up to version 0.1.4 can run operating‑system commands based on data it receives. If an attacker can supply crafted input, they could make the system execute unintended commands, potentially compromising the host. Update to the latest version that includes the provided fix to stop this behavior.

Original advisory text

publint package-manager pack.js child_process.exec os command injection

A vulnerability was detected in publint up to 0.1.4. This impacts the function child_process.exec of the file src/node/pack.js of the component package-manager Command Handler. The manipulation results in os command injection. Attacking locally is a requirement. The exploit is now public and may be used. The patch is identified as adf2d9a09945fc98c85a2520a89f441d78b2dbd8. It is advisable to implement a patch to correct this issue. The project maintainer explains: "I think it's very rare for someone to use this package with untrusted input".

References

https://vuldb.com/cve/CVE-2026-16631 Vendor Advisory
https://vuldb.com/submit/860239 Vendor Advisory
https://github.com/publint/publint/ URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16631... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-16631 Vendor Advisory
https://vuldb.com/vuln/382381 Vendor Advisory
https://github.com/publint/publint/issues/236 Third Party Advisory
https://vuldb.com/vuln/382381/cti Third Party Advisory
https://github.com/publint/publint/commit/adf2d9a09945fc98c85a2520a89f441d78b2db... Patch
https://github.com/publint/publint/pull/238 Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.9 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-77Command Injection

CWE-78OS Command Injection

Timeline

Published22 Jul 2026

Updated4 Nov 2026

First seen23 Jul 2026

Sources

CVE-2026-16631 · NVD

CVE-2026-16631 · OSV

Track software like this

Free during beta