CVE-2026-16628

A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function childprocess.exec of the component JIT Plugin Entry Handler. Performing a manipulation of the argument jitPlugins results in os command injection. The attack is only possible with local access. The...

CVE-2026-16628 oclif JIT Plugin Entry child_process.exec os command injection

A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function childprocess.exec of the component JIT Plugin Entry Handler. Performing a manipulation of the argument jitPlugins results in os command injection. The attack is only possible with local access. The...

CVE-2026-16628

The CVE-2026-16628 issue affects the oclif project up to version 4.23.16. The vulnerability lies in the JIT Plugin Entry Handler, where manipulating the jitPlugins argument allows local os command injection via child_process.exec. The attack requires local access; the exploit is public. A patch e...

Malicious code in oclif-dev (npm)

The package oclif-dev was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 9cf078178f5da45231528dbb9bb1883266f18b9c8cd4784a7c8542a3c3d4de7b This package installs a dependency hosted on a custom domain that runs an info...

Malicious code in oclif-typescript (npm)

The package oclif-typescript was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 588168406ce54991496f37d72c618c066f9326ccd7d9cf0a774edaf7bc4b4d4f This package installs a dependency hosted on a custom domain that runs a...

MAL-2025-42050 Malicious code in oclif-typescript (npm)

The package oclif-typescript was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 588168406ce54991496f37d72c618c066f9326ccd7d9cf0a774edaf7bc4b4d4f This package installs a dependency hosted on a custom domain that runs a...

MAL-2025-42049 Malicious code in oclif-dev (npm)

The package oclif-dev was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 9cf078178f5da45231528dbb9bb1883266f18b9c8cd4784a7c8542a3c3d4de7b This package installs a dependency hosted on a custom domain that runs an info...