Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow…
Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions. To remediate this issue, users should upgrade to version 0.103.0 and then re-synthesize the project so that .projen/tasks.json is regenerated with the corrected task definitions. Upgrading alone is not suff
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- VMware (Broadcom)
- Product
- workstation
- CVSS
- 7.8
- Fix
- available
Why it ranks 15 (Routine)
- CVSS 7.8 high
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-89066 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.