@oblique/cli version 15.4.0 contains an OS command injection vulnerability in its project creation functionality. The CLI tool constructs shell commands via string concatenation and executes them using Node.js execSync(). A user-supplied project-name argument is passed into these shell commands without proper sanitization or neutralization. This allows an attacker to inject shell metacharacters into the project name, causing additional arbitrary operating system commands to be executed. The vulnerability is triggered when the CLI is invoked with a specially crafted project name. This type of injection flaw can lead to full system compromise depending on the privileges of the user running the CLI. It is classified as a high-severity issue given the potential for arbitrary command execution on the host system.