CVE-2026-16630

A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function child_process.exec of the file package.json. The manipulation leads to os command injection. An attack has to be approached locally. The exploit has been disclosed publicly and may be used.

CVSS 4.0

1.9CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

5.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS

1.1% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-25)

CWEs

CWE-77, CWE-78

Published

2026-07-22

Modified

2026-10-24

Record from

the NVD, synced 2026-10-24

References

• https://github.com/syncfusion/ej2-javascript-ui-controls/
• https://github.com/syncfusion/ej2-javascript-ui-controls/issues/215
• https://vuldb.com/cve/CVE-2026-16630
• https://vuldb.com/submit/860232
• https://vuldb.com/vuln/382380

Check your stackJSON