@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace option. When an attacker can influence that option and the fallback npm execution path is reached, shell metacharacters in the workspace value can execute arbitrary operating-system commands with the privileges of the user running the CLI, allowing data access, file modification, or service disruption. This issue is fixed in version 6.0.0.

Source published

17 Sep 2026 14:35:39 UTC

Source modified

17 Sep 2026 15:30:52 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace option. When an attacker can influence that option and the fallback npm execution path is reached, shell metacharacters in the workspace value can execute arbitrary operating-system commands with the privileges of the user running the CLI, allowing data access, file modification, or service disruption. This issue is fixed in version 6.0.0.

Source published

Sep 17, 2026, 2:35:39 PM (timezone not stated)

Source modified

Sep 17, 2026, 3:30:52 PM (timezone not stated)

Observed here

11 Nov 2026 16:02:37 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace option. When an attacker can influence that option and the fallback npm execution path is reached, shell metacharacters in the workspace value can execute arbitrary operating-system commands with the privileges of the user running the CLI, allowing data access, file modification, or service disruption. This issue is fixed in version 6.0.0.

Source published

17 Sep 2026 15:16:51 UTC

Source modified

30 Sep 2026 17:51:36 UTC

Observed here

25 Oct 2026 15:18:57 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

## Summary A **Windows-specific** command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace <value>` option. User-supplied `--workspace` values can be passed to a shell command without proper neutralization on the Windows fallback execution path, enabling attackers to inject arbitrary OS commands. The vulnerability was fixed in version [6.0.0][v6.0.0]. ## Vulnerability Details When `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal command execution flow. On **Windows systems**, this path can interpret untrusted `--workspace` input as shell syntax if not safely handled. As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user. ## Impact An attacker who can influence the value passed to `--workspace` can execute arbitrary OS commands **on Windows hosts**. This may lead to: * Arbitrary command execution * Data exfiltration * Local privilege escalation (depending on runtime context and privileges) * Modification or destruction of files accessible to the user running the CLI The vulnerability affects only scenarios where: * The user invokes `cyclonedx-npm` with `--workspace <value>`, and * The vulnerable execution path is reached on **Windows**. ## Exploitation Conditions (High-Level) Exploitation requires the attacker to supply or influence the `--workspace` value passed to the CLI. If the tool falls back to the vulnerable shell execution path on **Windows**, specially crafted workspace identifiers can cause unintended command execution. No exploit code is included here to avoid providing weaponizable examples. ## Root Cause The CLI fallback execution path on **Windows** constructed a shell command using untrusted input from the `--workspace` option. Because the fallback code path does not sanitize or escape the workspace value, special shell metacharacters (e.g., `>`, `&`, `|`) are interpreted by the shell, enabling command injection. ## Fix The vulnerability was resolved in [PR #1489], which ensures workspace values are handled safely and are no longer passed to a vulnerable shell execution path. The fix is included in `@cyclonedx/cyclonedx-npm` version [6.0.0][v6.0.0]. ## Remediation * Upgrade to version [6.0.0][v6.0.0] or later, which contains the complete fix. * As a temporary mitigation for older versions, ensure that the environment variable `npm_execpath` is set to a `npm-cli.js` before invoking the tool. * Avoid passing untrusted or user-controlled values to the `--workspace` option. * If immediate upgrade is not possible, prioritize mitigation on **Windows systems**, where exploitability exists.

Source published

17 Sep 2026 14:50:40 UTC

Source modified

17 Sep 2026 15:00:05 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Publisher rating · HIGH