CVE-2026-16022 is a command injection flaw in @oblique/cli where the project-name parameter flows directly into execSync() without sanitization. This is the same pattern that has surfaced repeatedly in Vue CLI (2019), multiple create-* packages, and yeoman-related CVEs — it is a documented genotype in CLI scaffolding tooling that the ecosystem keeps reproducing.
If you use @oblique/cli, your immediate priorities: audit any automation that passes untrusted input to the project creation function — this includes branch names, artifact identifiers, or webhook payloads that feed into project-name. The attack surface is not the local developer typing their own project name; it is CI pipelines that invoke this tooling against data they did not generate. A command injection in a local CLI affects one workstation. The same flaw in CI runs against every commit, often with elevated permissions the original developers never considered.
The remediation window is compound, not single-event. The patch (presumably 15.4.1) fixes the current version, but npm does not retract historical tarballs. Every version prior to the patch — 15.3.0, 15.2.0, down the version history — remains exploitable in any environment where those versions resolve (common in Docker layers, cached CI images, or unpinned dependencies). Your lockfiles and dependency resolution behavior determine whether you're running the patched version or a vulnerable historical one.
The systemic failure here is not individual negligence — it is an ecosystem that publishes scaffolding tooling with shell execution paths and no input sanitization layer, then treats that code as beneath security scrutiny because it's 'just project setup.' The pattern will recur. Treat any CLI scaffolding tool that uses execSync with string concatenation as a high-risk surface until proven otherwise, regardless of whether it was 'never intended for untrusted input.' The pipeline that pulls it in doesn't know what the authors intended.