The vulnerability arises from the way @oblique/cli builds and executes shell commands during project creation. By concatenating a user-supplied project name directly into the command string and running it with execSync, the code permits shell metacharacters to be interpreted. An attacker can therefore inject and execute arbitrary operating‑system commands whenever the CLI is invoked with a crafted project name, potentially compromising confidentiality, integrity, and availability of the host system.

Swiss Federal Office of Information Technology, Systems and Telecommunication is known to use @oblique/cli 15.4.0, which is affected. No other versions or products have been confirmed to be influenced by this issue, but other installations of the same product version could also be at risk.

The CVSS score of 7.8 indicates a high severity for this command‑injection flaw (CWE‑78). The EPSS score is not available, and the vulnerability is not yet listed in CISA’s KEV catalog. Because the flaw relies on user‑controllable input that is not sanitized, it can be triggered by any user who can run the CLI with the vulnerable version. The attack path is straightforward—an attacker supplies a crafted project name to the CLI, causing the shell to execute arbitrary commands with the permissions of the executing user.