CVE-2026-57998: better-npm-audit OS Command Injection via registry flag
better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to childprocess.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a semicolon, pipe, or command substitution executes arbitrary operating system commands with the privileges of the process running the audit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
better-npm-auditto a version that resolves this vulnerability.Fixed in 4.0.0-rc.2 - Upgrade
Upgrade
better-npm-auditto a version that resolves this vulnerability.Fixed in 3.11.0 - Configuration
Do not pass a --registry value that contains shell metacharacters such as semicolons (;), pipes (|), or command substitution characters; provide only a plain registry URL/domain with no shell metacharacters to avoid command injection through interpolation into an exec()-spawned shell.
better-npm-audit CLI --registry option = validated/quoted (no shell metacharacters) - Compensating control
Ensure any wrapper or automation that runs better-npm-audit restricts/validates the user-supplied --registry parameter to an allowlist of expected registry domains/URLs before invoking better-npm-audit, so untrusted input cannot reach the exec()-based command string.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any environment running better-npm-audit through 3.11.0 or the 4.0.0-rc.2 prerelease is exposed when an attacker can influence the value passed to its --registry option. The injected command runs with the privileges of the process that runs the audit.
Does exploitation require an authenticated account or special permissions?
No special application privileges are described. Exploitation requires the attacker to cause a malicious --registry value to be used and requires user interaction according to the supplied CVSS vector.
What can be done if patching is not immediately possible?
Do not pass untrusted values to --registry. Restrict the option to validated registry URLs and prevent shell metacharacters, including semicolons, pipes, and command-substitution syntax, from reaching the command.
How can I determine whether a deployment is affected?
Check whether better-npm-audit is at version 3.11.0 or earlier, or is using the 4.0.0-rc.2 prerelease. Also review scripts, CI configuration, and user-controlled inputs that supply the --registry option.