@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

## Summary A command injection vulnerability existed in the Maven scanning flow of cdxgen before version 12.4.3. When cdxgen scanned an attacker-controlled Maven project, repository-controlled paths could be used in the Maven command construction. In affected versions, some Maven invocations were executed with `shell: true`. A directory name containing shell metacharacters could therefore be interpreted by the shell instead of being treated only as a filesystem path. This could allow an attacker who controls a scanned repository to execute commands in the cdxgen process context. The issue affected both the CLI and server mode. The issue is patched in `12.4.3`. ## Affected asset - Project: cdxgen - Tested version: 12.4.1 - Mode tested: server mode - Endpoint: `POST /sbom` - Scanner path: Java / Maven project scanning ## Patch Version 12.4.3 includes hardening for this issue with PR #4059 The patch adds multiple mitigations: - Maven command invocations no longer use unconditional shell execution on POSIX platforms. - Bazel command invocation was similarly changed away from unconditional shell execution. - Windows compatibility is preserved using `shell: isWin` where needed. - `safeSpawnSync` now blocks `shell: true` invocations when the command or direct argument values contain shell metacharacters. - cdxgen does not validate or sanitise every nested directory. The threat model is updated to clarify mitigation scope. ## Workarounds The recommended remediation is to upgrade to 12.4.3 or later. If immediate upgrade is not possible: - Do not run cdxgen server mode on untrusted networks. - Do not expose POST /sbom to unauthenticated or untrusted clients. - Avoid scanning untrusted Java/Maven repositories. - Run cdxgen inside a locked-down container or sandbox. - Remove sensitive environment variables from the cdxgen process environment. - Use least-privilege filesystem mounts. - Restrict outbound network access where possible. Use cdxgen secure/dry-run modes where suitable to inspect planned operations before performing scans. Configure host and command allowlists where applicable, such as: - CDXGEN_SERVER_ALLOWED_HOSTS - CDXGEN_GIT_ALLOWED_HOSTS - CDXGEN_ALLOWED_COMMANDS - CDXGEN_SECURE_MODE=true These mitigations reduce exposure but do not fully address the vulnerable command construction in affected versions. ## Threat model clarification The mitigation added in 12.4.3 applies to the cdxgen process boundary. Specifically, cdxgen now hardens command, option, and path values that cdxgen itself passes to external processes through safeSpawnSync. This does not mean cdxgen sanitizes every nested path, module name, generated path, or project-controlled value that an external build tool later discovers and interprets inside its own process. Once cdxgen safely invokes Maven, Gradle, Bazel, SBT, or another build tool, that tool’s internal behavior remains a separate trust boundary. ### In scope for this fix: - command and argument values passed directly by cdxgen to child processes; - cdxgen’s own use of shell: true; - Maven/Bazel command invocation paths controlled by cdxgen. ### Out of scope for this specific mitigation: - arbitrary nested paths later discovered by Maven itself; - Maven plugin behavior; - Maven lifecycle hooks; - build-tool-specific interpretation of project files after cdxgen has launched the tool. This residual risk is documented in the cdxgen threat model and is why untrusted project scans should still be run in sandboxed, least-privileged environments. ## Detection Possible indicators of exploitation or probing include: - Maven module directories containing shell metacharacters such as: ``` ; & | < > $ backticks newlines ``` - Logs showing settings.xml or pom.xml discovered in suspicious paths. - Unexpected files created outside the scanned repository during a Java/Maven scan. - Unexpected child process behavior during cdxgen server scans. - cdxgen server receiving POST /sbom requests for attacker-controlled Git URLs. Example suspicious path pattern: ``` evil;cd${IFS}..;cd${IFS}..;printf${IFS}...>...;# ``` ## Credits Reported-By: @aleff-github ## Resources - Patch PR - https://github.com/cdxgen/cdxgen/pull/4059

Source published

26 Jun 2026 19:47:24 UTC

Source modified

10 Sep 2026 03:51:07 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Publisher rating · MODERATE