CVE-2026-16735

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-16735

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16735.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-16735

Published

2026-07-23T13:45:09.720Z

Modified

2026-07-28T03:55:59.021913380Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

release-it conventional-changelog Changelog File index.js writeChangelog os command injection

Details

A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16735.json",
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ]
}

References

Affected packages

Git / github.com/release-it/conventional-changelog

Affected ranges

Type

GIT

Repo

https://github.com/release-it/conventional-changelog

Events

Introduced

981e7b07a7ff7fdc3ba625974dc34a81999f416a

Last affected

82f88c9a4f3a185fb166c1eeada0c6c46c9856b4

Database specific

{
    "extracted_events": [
        {
            "introduced": "11.0.0"
        },
        {
            "last_affected": "11.0.0"
        },
        {
            "introduced": "11.0.1"
        },
        {
            "last_affected": "11.0.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

11.*

11.0.0

11.0.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16735.json"