CVE-2026-16735

A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...

CVE-2026-16735 release-it conventional-changelog Changelog File index.js writeChangelog os command injection

A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...

CVE-2026-16735

The CVE concerns release-it conventional-changelog up to 11.0.1, where the writeChangelog function in index.js of the Changelog File Handler is vulnerable. Manipulation of the infile argument enables local OS command injection, with the exploit publicly disclosed. The attack is local and requires...

CVE-2026-16735 release-it conventional-changelog Changelog File index.js writeChangelog os command injection

A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...

EUVD-2025-177420

Malicious code in ora-release-it-ichnology-subscription npm...

EUVD-2025-178975

Malicious code in exoplanet-titan-repository-release-it npm...

EUVD-2025-178776

Malicious code in ganymede-nestjs-izar-release-it npm...

EUVD-2025-176517

Malicious code in saturnology-astroinformatics-release-it-test npm...

EUVD-2025-176710

Malicious code in release-it-library-start-inquirer npm...

EUVD-2025-177121

Malicious code in plutology-release-it-despina-arcturus npm...

EUVD-2025-176708

Malicious code in release-it-nova-orbit-figures npm...

Malicious code in release-it-biogeochemistry-geoarchaeology-protractor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5743b02a4835cd12ed5f2fe483d4025048b9db674a57d31bcc2707937ddca19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176711

Malicious code in release-it-juno-cypress-ganymede npm...

EUVD-2025-178340

Malicious code in iota-release-it-stream-xenos npm...

EUVD-2025-177753

Malicious code in morgan-sass-loader-release-it-quark npm...

EUVD-2025-179873

Malicious code in carpo-release-it-oberon-halley npm...

EUVD-2025-179932

Malicious code in bunyan-release-it-carpo-request npm...

EUVD-2025-176554

Malicious code in sagitta-schema-release-it-husky npm...

Malicious code in release-it-nova-orbit-figures (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 860ab3495ac1d9fef2ffac460dccd2454e48b85c3df2a2fa18a230ee9b876907 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in release-it-library-start-inquirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 348aaa3d96cbbca9efb6a3b8e5c7e01f9bfc1413dce9e60070864b028329ab09 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...