Protection Mechanism Failure Affecting safeinstall-cli package, versions <0.10.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-SAFEINSTALLCLI-17950991
- published11 Jul 2026
- disclosed10 Jul 2026
- creditUnknown
Introduced: 10 Jul 2026
New CVE NOT AVAILABLE CWE-178 (opens in a new tab)How to fix?
Upgrade safeinstall-cli to version 0.10.2 or higher.
Overview
safeinstall-cli is a Local-first CLI that blocks risky npm, pnpm, and bun installs before they run. Open source.
Affected versions of this package are vulnerable to Protection Mechanism Failure through improper shell command parsing in the agent guard. An attacker can execute arbitrary commands with the permissions of the developer account by crafting shell commands that bypass policy evaluation and enforcement, potentially compromising local source code, credentials, and development resources. This is only exploitable if a coding agent acts on attacker-influenced instructions and issues the crafted shell command.
Workaround
This vulnerability can be mitigated by manually reviewing every coding-agent shell command and preventing the agent from invoking package managers or registry runners directly.