Command Injection Affecting cli-onprem package, versions [,1.5.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-CLIONPREM-13807333
- published2 Nov 2025
- disclosed1 Nov 2025
- creditUnknown
Introduced: 1 Nov 2025
New CVE NOT AVAILABLE CWE-78 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade cli-onprem to version 1.5.1 or higher.
Overview
cli-onprem is a CLI tool for infrastructure engineers
Affected versions of this package are vulnerable to Command Injection due to the use of shell-invoked subprocess calls with unvalidated input. An attacker can execute arbitrary commands by injecting shell metacharacters in the directory and pattern variables used by the calculate_sha256_manifest and merge_files functions.