@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-55849 · Microsoft / collected KEV context

EUVD-2026-42432

GHSA-v75r-vx73-82pj

cve-program · CVE-2026-55849

• https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj
• https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476
• https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f
• https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0

euvd · EUVD-2026-42432

• https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj
• https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476
• https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f
• https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0

nvd · CVE-2026-55849

• https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f
• https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476
• https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0
• https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj

osv · GHSA-v75r-vx73-82pj

• https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj
• https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476
• https://github.com/CycloneDX/cyclonedx-node-npm
• https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0

No related operational record is retained in the current change model.