CVE-2026-16631 - publint package-manager pack.js child_process.exec os command injection

Back Back to CVE browser

MEDIUM

publint package-manager pack.js child_process.exec os command injection

Published Jul 22, 2026

4.8

MEDIUM

CVSS 4.0

EPSS 1.08%

Description

A vulnerability was detected in publint up to 0.1.4. This impacts the function child_process.exec of the file src/node/pack.js of the component package-manager Command Handler. The manipulation results in os command injection. Attacking locally is a requirement. The exploit is now public and may be used. The patch is identified as adf2d9a09945fc98c85a2520a89f441d78b2dbd8. It is advisable to implement a patch to correct this issue. The project maintainer explains: "I think it's very rare for someone to use this package with untrusted input".

Affected products

Vendor Publint Product Publint Default
n/a
- Version
  0.1.0
  Status
  affected
  Constraints
  -
- Version
  0.1.1
  Status
  affected
  Constraints
  -
- Version
  0.1.2
  Status
  affected
  Constraints
  -
- Version
  0.1.3
  Status
  affected
  Constraints
  -
- Version
  0.1.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Publint

n/a

Version	Status	Constraints
0.1.0	affected	-
0.1.1	affected	-
0.1.2	affected	-
0.1.3	affected	-
0.1.4	affected	-

Red Hat Enterprise Linux 10

grafana

Not affected
Red Hat Hardened Images

grafana12.4

Not affected
Red Hat Hardened Images

grafana13.1

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	grafana	Not affected	n/a
Red Hat Hardened Images	grafana12.4	Not affected	n/a
Red Hat Hardened Images	grafana13.1	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-77

CWE-78

OS Command Injection

References (13)

https://access.redhat.com/security/cve/CVE-2026-16631
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2506329
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-47863
Advisory
https://github.com/publint/publint/
product
https://github.com/publint/publint/commit/adf2d9a09945fc98c85a2520a89f441d78b2dbd8
patch
https://github.com/publint/publint/issues/236
exploitissue-tracking
https://github.com/publint/publint/pull/238
issue-trackingpatch
https://nvd.nist.gov/vuln/detail/CVE-2026-16631
https://vuldb.com/cve/CVE-2026-16631
third-party-advisory
https://vuldb.com/submit/860239
third-party-advisory
https://vuldb.com/vuln/382381
vdb-entrytechnical-description
https://vuldb.com/vuln/382381/cti
signaturepermissions-required
https://www.cve.org/CVERecord?id=CVE-2026-16631

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-16631		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2506329		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-47863		Advisory
https://github.com/publint/publint/		product
https://github.com/publint/publint/commit/adf2d9a09945fc98c85a2520a89f441d78b2dbd8		patch
https://github.com/publint/publint/issues/236		exploitissue-tracking
https://github.com/publint/publint/pull/238		issue-trackingpatch
https://nvd.nist.gov/vuln/detail/CVE-2026-16631
https://vuldb.com/cve/CVE-2026-16631		third-party-advisory
https://vuldb.com/submit/860239		third-party-advisory
https://vuldb.com/vuln/382381		vdb-entrytechnical-description
https://vuldb.com/vuln/382381/cti		signaturepermissions-required
https://www.cve.org/CVERecord?id=CVE-2026-16631