@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-71538 · Microsoft / collected KEV context

EUVD-2026-81665

GHSA-q69g-4hcv-6jg4

cve-program · CVE-2026-71538

• https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-q69g-4hcv-6jg4
• https://github.com/CycloneDX/cyclonedx-node-npm/pull/1489
• https://github.com/CycloneDX/cyclonedx-node-npm/commit/15d3beb5bcd2b0b6eccfdf31192f5103b3f12c0f
• https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v6.0.0

euvd · EUVD-2026-81665

• https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-q69g-4hcv-6jg4
• https://github.com/CycloneDX/cyclonedx-node-npm/pull/1489
• https://github.com/CycloneDX/cyclonedx-node-npm/commit/15d3beb5bcd2b0b6eccfdf31192f5103b3f12c0f
• https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v6.0.0

nvd · CVE-2026-71538

• https://github.com/CycloneDX/cyclonedx-node-npm/commit/15d3beb5bcd2b0b6eccfdf31192f5103b3f12c0f
• https://github.com/CycloneDX/cyclonedx-node-npm/pull/1489
• https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v6.0.0
• https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-q69g-4hcv-6jg4

osv · GHSA-q69g-4hcv-6jg4

• https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-q69g-4hcv-6jg4
• https://github.com/CycloneDX/cyclonedx-node-npm/pull/1489
• https://github.com/CycloneDX/cyclonedx-node-npm/commit/15d3beb5bcd2b0b6eccfdf31192f5103b3f12c0f
• https://github.com/CycloneDX/cyclonedx-node-npm
• https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v6.0.0

No related operational record is retained in the current change model.