A flaw in publint’s package‑manager component enables an attacker with local execution rights to inject arbitrary operating‑system commands via an unsanitized child_process.exec call in src/node/pack.js. The vulnerability arises from the component accepting external input that is directly passed to exec without escaping, allowing the execution of unintended commands. Because the exploit requires local access, the attacker must be able to run publint on the target system; once achieved, the impact extends to confidentiality, integrity, and availability of that system.

The affected product is publint, a JavaScript package used for package validation. Versions up to and including 0.1.4 are vulnerable; the patch identified by commit hash adf2d9a09945fc98c85a2520a89f441d78b2dbd8 removes the flaw in the package‑manager’s child_process.exec usage.

The CVSS base score is 4.8, indicating moderate severity. The EPSS score is < 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, so widespread exploitation is not yet reported. The attack vector is local; an attacker must run publint with untrusted input. Once the exploit is triggered, it can lead to full remote code execution on the host.