A flaw in oclif up to version 4.23.16 allows a local attacker to supply a crafted value for the jitPlugins argument that is passed directly to child_process.exec, enabling OS command injection. The attacker can execute arbitrary commands with the privileges of the user running the CLI, potentially compromising local resources. This vulnerability is an instance of CWE-77 and CWE-78.

The vulnerability impacts any installation of the oclif command‑line framework that uses the JIT Plugin Entry handler, specifically versions 4.23.16 or earlier that have not applied the fix. Any deployment that enables the jitPlugins feature is at risk.

The CVSS score of 4.8 indicates moderate severity. The EPSS score of < 1% indicates an extremely low probability of exploitation, and it is not listed in CISA KEV, implying no known widespread attacks yet. The attack requires local access; therefore, an attacker must be able to run the oclif CLI on the target system. While the exploit is not remote, it allows a local attacker to execute commands with the same privileges as the user, which can lead to significant compromise of the local environment.