Advisory severityMedium5.3Red Hat Linux

Medium [CVE-2026-16631] Arbitrary Command Execution via OS Command Injection

This medium-severity Red Hat Linux advisory covers CVE-2026-16631.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-16631 Source published Jul 22, 2026Source updated Jul 22, 2026

VulniPulse record published Jul 31, 2026Record updated Aug 11, 2026

CVE-2026-16631

Affected products & platforms

Red Hat LinuxUnclassified

Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

A vulnerability was detected in publint up to 0.1.4. This impacts the function child_process.exec of the file src/node/pack.js of the component package-manager Command Handler.

The manipulation results in os command injection. Attacking locally is a requirement.

The exploit is now public and may be used. The patch is identified as adf2d9a09945fc98c85a2520a89f441d78b2dbd8.

It is advisable to implement a patch to correct this issue. The project maintainer explains: "I think it's very rare for someone to use this package with untrusted input".

This allows the attacker to execute arbitrary commands on the system where publint is running, potentially leading to unauthorized system access or data manipulation. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

Weakness: CWE-78. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Hardened Images as not affected.

Affected versions

0.1.4

Official advisory · high-confidence parse· fetched 11 days ago·verify at source

Fixed versions

No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.

Official advisory · high-confidence parse· fetched 11 days ago·verify at source

Mitigation

The source record does not include mitigation steps. That is not a statement that no fix exists — read the vendor advisory below for the authoritative guidance.

Official advisory · high-confidence parse· fetched 11 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.