Summary
A high-severity OS command injection vulnerability in the @oblique/cli project creation functionality allows a user-controlled project name to influence a shell command.
When the CLI is invoked with a crafted project-name argument, shell metacharacters may cause additional operating-system commands to execute with the privileges of the calling process.
Affected context
The vulnerability occurs in the @oblique/cli project creation workflow when the CLI builds a shell command from a project-name argument and executes it through a shell-backed API. Deployments or development environments where an attacker can influence the project name passed to the CLI may be exposed, particularly when the CLI runs with elevated permissions or access to sensitive files and systems.
Exploit preconditions
- Attack surface: The project creation command exposed by the @oblique/cli CLI
- Required access: Ability to invoke the CLI or cause it to process a user-controlled project-name argument
- Trigger point: Construction and execution of the project creation shell command
- Why exploitation is possible: The project name is incorporated through string concatenation without adequate shell-argument neutralization, allowing shell interpretation of attacker-controlled input
Why this happens
The underlying issue is the construction of shell commands by concatenating untrusted input and passing the resulting string to execSync().
This pattern allows command interpreters to treat embedded shell syntax as executable control data rather than as a literal project name. It maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
Potential impact
- An attacker may execute arbitrary operating-system commands
- The local development environment or automation runner could be compromised
- Sensitive files, credentials, or environment variables could be exposed
- Project files or generated artifacts could be modified or deleted
- Additional systems may be affected if the process has network or administrative privileges
General mitigation guidance
Mitigation generally focuses on avoiding shell interpretation and reducing trust in command arguments.
Common defensive patterns include:
- Prefer direct process-spawn APIs that pass arguments separately and do not invoke a shell
- Apply strict validation and allowlisting for project-name formats
- Treat command-line values as data rather than concatenated command fragments
- Use narrowly scoped process privileges and isolated execution environments
- Restrict access to credentials, filesystems, and network resources available to the CLI
- Avoid granting elevated permissions to project-generation workflows
How teams detect issues like this
Organizations can detect this class of issue through:
- Static analysis rules identifying string concatenation or interpolation in shell command construction
- Code review checks for
execSync(), shell-enabled process APIs, and untrusted command-line arguments - Tests that verify special characters remain literal rather than altering process behavior
- Policy enforcement requiring argument-array process execution for user-influenced values
- Runtime monitoring for unexpected child processes launched by CLI workflows
Automated security review tools may help identify shell command execution paths that receive unsanitized input.
