CVE-2026-16735 | release-it conventional-changelog up to 11.0.1 Changelog File index.js writeChangelog infile os command injection (Issue 149)

July 23, 2026 Yanac

A vulnerability described as critical has been identified in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection.

This vulnerability is listed as CVE-2026-16735. The attack must be carried out locally. In addition, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More