CVE-2026-71538: @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npmexecpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace option. When an attacker can influence that option and the fallback npm execution path is reached, shell metacharacters in the workspace value can execute arbitrary operating-system commands with the privileges of the user running the CLI, allowing data access, file modification, or service disruption. This issue is fixed in version 6.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@cyclonedx/cyclonedx-npmto a version that resolves this vulnerability.Fixed in 6.0.0
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
The vulnerable code path is specific to Windows and is reached only when npm_execpath does not provide the npm CLI path, causing the tool to use its fallback npm execution path.
What must an attacker control to exploit the vulnerability?
An attacker must be able to influence the value supplied through the --workspace option. Exploitation also requires the Windows fallback npm execution path to be used.
What can be done if an immediate upgrade is not possible?
Avoid running the CLI with --workspace values influenced by untrusted users or inputs, and avoid the Windows fallback execution path where possible. Run the CLI with the least privileges necessary to limit the effect of command execution.
What is the remediation?
Upgrade @cyclonedx/cyclonedx-npm to version 6.0.0, which fixes the issue.