The flaw exists in the writeChangelog function of the @release‑it/conventional‑changelog package, where the infile argument is passed unvalidated to OS-level commands. A locally privileged attacker can supply a crafted infile value that causes arbitrary operating‑system commands to be executed during changelog generation. The issue is classified under CWE‑77 and CWE‑78 and can compromise the confidentiality, integrity, and availability of the local system, with risk limited to the environment in which the vulnerable code runs.

The affected product is release‑it conventional‑changelog, versions up to 11.0.1. No later official patches are listed in the provided data.

The CVSS score of 4.8 indicates a low‑to‑medium severity, and the EPSS score of less than 1% suggests a very low exploitation probability at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation has been observed. Based on the description, the attack must be carried out locally, so it requires the attacker to gain local file system access (e.g., via an exploited process, unauthorized login, or supply of a crafted file). Once local, an attacker can provide a specially crafted infile to trigger the command injection and run arbitrary commands under the process’s effective user.