CVE-2026-16733

Publié : 23 juillet 2026

Modifié : 23 juillet 2026

Score CVSS

5.3

MEDIUM

Description détaillée

A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Références et Patchs

https://github.com/bahmutov/find-cypress-specs/https://github.com/bahmutov/find-cypress-specs/issues/423 https://vuldb.com/cve/CVE-2026-16733 https://vuldb.com/submit/861021 https://vuldb.com/vuln/382478 https://vuldb.com/vuln/382478/cti

Dernières Vulnérabilités

CVE-2026-65761

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions.

VOIR DÉTAILS

CVE-2026-65760

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system.

VOIR DÉTAILS

CVE-2026-65759

Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary orders.

VOIR DÉTAILS