{"id":"GHSA-v75r-vx73-82pj","revision":null,"records":[{"revision":"890082b38c634527a8684bb3911354e6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-55849","aliases":[],"title":"@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument","description":"@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.","state":0,"publishedAt":"2026-07-08T21:10:15.798+00:00","modifiedAt":"2026-07-09T19:36:40.011+00:00","affected":[{"ecosystem":"Vendor product","name":"cyclonedx-node-npm","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"CycloneDX\",\n                    \"product\": \"cyclonedx-node-npm\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 2.1.0, < 5.0.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.5,"severity":"HIGH"}],"references":["https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj","https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476","https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f","https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-55849","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-55849","identifiers":["CVE-2026-55849"]},"retained":false,"historicalAffected":[]},{"revision":"5d16755dfee54f4595bb05dfcd4edaad","observedAt":"2026-11-07T12:34:26.803+00:00","statement":{"source":"euvd","id":"EUVD-2026-42432","aliases":["CVE-2026-55849","GHSA-v75r-vx73-82pj"],"title":"@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty,…","description":"@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.5,"severity":null}],"references":["https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj","https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476","https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f","https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42432","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 8, 2026, 9:10:15 PM","dateUpdated":"Jul 9, 2026, 7:36:40 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-42432","identifiers":["EUVD-2026-42432","CVE-2026-55849","GHSA-v75r-vx73-82pj"]},"retained":false,"historicalAffected":[]},{"revision":"b37c63684682425294d4da2f91baa922","observedAt":"2026-10-27T15:15:14.036+00:00","statement":{"source":"nvd","id":"CVE-2026-55849","aliases":[],"title":"@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty,…","description":"@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.","state":0,"publishedAt":"2026-07-08T22:17:15.783+00:00","modifiedAt":"2026-10-25T17:10:00.197+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.5,"severity":"HIGH"}],"references":["https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f","https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476","https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0","https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55849","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-78"],"productCriteria":[],"sourceDates":{"published":"2026-07-08T22:17:15.783","lastModified":"2026-10-25T17:10:00.197"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-55849","identifiers":["CVE-2026-55849"]},"retained":false,"historicalAffected":[]},{"revision":"df0a82c81aaa4ecfb2fe98316392a392","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-v75r-vx73-82pj","aliases":["CVE-2026-55849"],"title":"@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument","description":"## Summary\nA command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace <value>` option while the environment variable `npm_execpath` is unset or empty.  \nUser‑supplied `--workspace` values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands.  \nThis issue corresponds to **CWE‑78**: Improper Neutralization of Special Elements used in an OS Command.\n\nThe vulnerability was fixed in version [5.0.0][v5.0.0].\n\n## Vulnerability Details\n\nWhen `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal shell command.  \nIf the environment variable `npm_execpath` is set, the tool uses the npm executable directly and no injection occurs.  \nHowever, when `npm_execpath` is unset or empty, the tool falls back to spawning a subshell and interpolating the `--workspace` value directly into the command string without proper escaping or neutralization.\n\nAs a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user.\n\n## Impact\n\nAn attacker who can influence the value passed to `--workspace` can execute arbitrary OS commands.  \nThis may lead to:\n\n* Arbitrary command execution\n* Data exfiltration\n* Local privilege escalation (depending on how the tool is used)\n* Modification or destruction of files accessible to the user running the CLI\n\nThe vulnerability affects only scenarios where:\n* The user invokes `cyclonedx-npm` with `--workspace <value>`, and\n* The environment variable `npm_execpath` is unset or empty\n\n## Exploitation Conditions (High‑Level)\n\nExploitation requires the attacker to supply or influence the `--workspace` value passed to the CLI.  \nIf the tool falls back to its subshell execution path, specially crafted workspace identifiers can cause unintended command execution.  \nNo exploit code is included here to avoid providing weaponizable examples.\n\n## Root Cause\n\nThe CLI constructs a shell command using untrusted input from the `--workspace` option.  \nBecause the fallback code path does not sanitize or escape the workspace value, special shell metacharacters (e.g., `;`, `&&`, `|`) are interpreted by the shell, enabling command injection.\n\nThis behavior matches **CWE‑78**.\n\n## Fix\n\nThe vulnerability was resolved in [PR #1476], which ensures that workspace values are handled safely and are no longer passed to a subshell in an unsafe manner.\n\nThe fix is included in `@cyclonedx/cyclonedx-npm` version [5.0.0][v5.0.0].\n\n## Remediation\n\n* Upgrade to version [5.0.0][v5.0.0] or later, which contains the complete fix.\n* As a temporary mitigation for older versions, ensure that the environment variable `npm_execpath` is set before invoking the tool.\n* Avoid passing untrusted or user‑controlled values to the `--workspace` option.\n\n[v5.0.0]: https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0\n[PR #1476]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476","state":0,"publishedAt":"2026-06-19T20:47:48+00:00","modifiedAt":"2026-09-10T03:50:50.5875966+00:00","affected":[{"ecosystem":"npm","name":"@cyclonedx/cyclonedx-npm","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.1.0"},{"kind":"fixed","version":"5.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj","https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476","https://github.com/CycloneDX/cyclonedx-node-npm","https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0"],"sourceUrl":"https://github.com/advisories/GHSA-v75r-vx73-82pj","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-v75r-vx73-82pj","identifiers":["GHSA-v75r-vx73-82pj","CVE-2026-55849"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.018923+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0189237+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-5978693a555a2fac0feee4f8e1cdc5e013b9a91b16046d4e34ae63a3d3db8d19","complete":true,"records":420947,"lastAttemptAt":"2026-11-07T21:52:16.4606105+00:00","lastSuccessAt":"2026-11-07T21:52:16.3995215+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.4606105+00:00","snapshotPublishedAt":"2026-11-07T21:18:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c91a0736a9624a48aebf081ca5dd86b2","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T22:04:27.1191985+00:00","lastSuccessAt":"2026-11-07T22:04:27.115+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:04:27.115+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.0199092+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0199095+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2b22c2d15f834007aa54c93f73b8deaf","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T21:52:42.2590883+00:00","lastSuccessAt":"2026-11-07T21:52:42.255+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:42.255+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T21:52:16.7352005+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7352005+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T21:52:16.5087916+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.5087916+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T21:52:16.7531721+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7531721+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T21:52:16.6283313+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.6283313+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}