cyclonedx-npm CVE-2026-55849
HIGH
GHSA-v75r-vx73-82pj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInfluence --workspace value in build/CI config
-
DeliveryInvoke cyclonedx-npm with npm_execpath unset
-
ExploitMetacharacters break out of subshell command
-
ExecutionArbitrary OS command runs as invoking user
-
ImpactData exfiltration or file destruction
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Two concrete conditions must both hold: (1) the cyclonedx-npm CLI is invoked with the --workspace (or -w) option carrying an attacker-influenced value, and (2) the environment variable npm_execpath is unset or empty, which triggers the subshell fallback path in npmRunner.ts (if npm_execpath is set, npm is executed directly and no injection occurs). Limiting factors that reduce real-world exposure: the attack vector is LOCAL (AV:L) and requires user interaction (UI:P), so a victim or automation must actually run the tool with the poisoned argument; the tool is commonly launched via npm scripts where npm_execpath is automatically populated, making the vulnerable path a non-default condition; and the attacker only gains the privileges of the invoking user, so impact scales with how the CLI is deployed (privileged CI runner versus unprivileged developer shell). |
| Impact | The only scored signal provided is a CVSS 4.0 base of 8.5 (High) with vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, indicating a LOCAL attack vector requiring passive user interaction but no attacker privileges, with high confidentiality, integrity and availability impact and no scope change. There is no CVSS 3.1 vector, no EPSS score, no SSVC decision, and no CISA KEV entry in the input, so exploitation probability cannot be quantified numerically. Critically, the CVSS 4.0 AV:L rating contradicts any 'remote' framing: real risk depends entirely on whether an attacker can influence the --workspace value AND force the non-default npm_execpath-unset code path - two conditions frequently NOT met, since the tool is usually run via npm scripts where npm_execpath is set. This is therefore a real but conditional/local issue best characterized as a supply-chain/CI hazard (attacker-controlled workspace names flowing into an SBOM step) rather than a broadly exploitable network vulnerability. The high CVSS impact is legitimate, but the local vector plus dual configuration prerequisites materially lower real-world priority relative to a raw 8.5 reading. |
| Exploit ScenarioDerived | In a CI pipeline that generates an SBOM, an attacker who can influence a project's workspace identifier (for example via a crafted package.json workspace name or a pipeline parameter) supplies a value containing shell metacharacters such as '; <command> ;'. When cyclonedx-npm is invoked with that value as --workspace while npm_execpath is unset, the subshell interprets the metacharacters and runs the attacker's command as the CI/build user. The vendor's regression test in PR #1476 demonstrates exactly this by writing a sentinel file through an injected touch/type command, confirming exploitability, though no weaponized public exploit was found. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 08, 2026
Command injection in the @cyclonedx/cyclonedx-npm SBOM generator (versions >= 2.1.0, < 5.0.0) lets an attacker who controls the value passed to the --workspace CLI option execute arbitrary OS commands when the npm_execpath environment variable is unset or empty. In that fallback path the tool spawns a subshell and interpolates the workspace value into a command string without escaping, so shell metacharacters break out of the intended context and run with the invoking user's privileges. No public exploit identified at time of analysis, though the vendor fix PR ships a proof-of-concept-style regression test; the issue is not listed in CISA KEV and no EPSS score was provided.
Earlier versions of this analysis (2)
Arbitrary OS command execution in the @cyclonedx/cyclonedx-npm SBOM generator (versions >= 2.1.0 and < 5.0.0) occurs when the CLI is run with a --workspace value while the npm_execpath environment variable is unset or empty, causing the tool to fall back to a subshell that interpolates the workspace string unescaped. An actor able to influence that argument can inject shell metacharacters and run commands as the invoking user. There is no public exploit identified at time of analysis and it is not in CISA KEV, though the vendor's own regression test in PR #1476 demonstrates the injection with a sentinel file.
Command injection in @cyclonedx/cyclonedx-npm versions 2.1.0 through 4.x allows arbitrary OS command execution when the CLI is invoked with --workspace and the npm_execpath environment variable is unset or empty, causing the tool to fall back to an unsanitized subshell invocation. Exploitation requires an attacker to influence the --workspace argument value passed to the CLI; no public exploit identified at time of analysis, but the patch PR #1476 includes regression tests that demonstrate the injection path. Affected primarily in CI/CD and SBOM-generation pipelines where workspace names may originate from semi-trusted repository metadata.
RemediationAI
Vendor-released patch: upgrade to @cyclonedx/cyclonedx-npm version 5.0.0 or later, which reworks npm handling to execute npm explicitly rather than through a subshell (a documented BREAKING change per HISTORY.md, so validate your SBOM pipeline after upgrading since npm resolution behavior changed). The fix is in PR #1476 (https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476) with release notes at https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0. As a temporary mitigation for versions that cannot be upgraded, explicitly set the npm_execpath environment variable to a valid npm executable path before every invocation, which forces the safe direct-execution path and avoids the subshell fallback; the trade-off is that this must be enforced consistently across all invocation contexts (CI runners, wrapper scripts, cron) or the vulnerable path can still be reached. Additionally, never pass untrusted or externally-controlled values to the --workspace / -w option, and route affected pipeline owners to the advisory at https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
@cyclonedx/cyclonedx-npm is a Node.js command-line tool that generates CycloneDX Software Bill of Materials (SBOM) documents by querying the npm package manager for a project's dependency tree. The vulnerable logic lives in src/npmRunner.ts, which decides how to invoke npm: when the npm_execpath environment variable is present (as it normally is when the tool is launched via an npm script) it executes npm directly and is safe; when npm_execpath is unset or empty it falls back to execSync('npm ' + args.join(' ')), building a single shell command string from user-supplied arguments including --workspace. Because that string is handed to a shell, the untrusted workspace value is subject to shell interpretation. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CPE pkg:npm/@cyclonedx_cyclonedx-npm confirms the sole affected artifact is the npm package.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local dev/CI tool so AV:L; a victim must run the CLI with the poisoned argument giving UI:R; attacker needs no prior privileges (PR:N) and command injection yields full C/I/A as the invoking user.
Primary rating from Vendor (https://github.com/CycloneDX/cyclonedx-node-npm).
CVSS VectorVendor: https://github.com/CycloneDX/cyclonedx-node-npm
Lifecycle Timeline
3DescriptionCVE.org
Summary
A command injection vulnerability exists in @cyclonedx/cyclonedx-npm when the CLI is invoked with the --workspace <value> option while the environment variable npm_execpath is unset or empty. User‑supplied --workspace values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands. This issue corresponds to CWE‑78: Improper Neutralization of Special Elements used in an OS Command.
The vulnerability was fixed in version [5.0.0][v5.0.0].
Vulnerability Details
When cyclonedx-npm is executed with the --workspace option, the provided argument is incorporated into an internal shell command. If the environment variable npm_execpath is set, the tool uses the npm executable directly and no injection occurs. However, when npm_execpath is unset or empty, the tool falls back to spawning a subshell and interpolating the --workspace value directly into the command string without proper escaping or neutralization.
As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user.
Impact
An attacker who can influence the value passed to --workspace can execute arbitrary OS commands. This may lead to:
- Arbitrary command execution
- Data exfiltration
- Local privilege escalation (depending on how the tool is used)
- Modification or destruction of files accessible to the user running the CLI
The vulnerability affects only scenarios where:
- The user invokes
cyclonedx-npmwith--workspace <value>, and - The environment variable
npm_execpathis unset or empty
Exploitation Conditions (High‑Level)
Exploitation requires the attacker to supply or influence the --workspace value passed to the CLI. If the tool falls back to its subshell execution path, specially crafted workspace identifiers can cause unintended command execution. No exploit code is included here to avoid providing weaponizable examples.
Root Cause
The CLI constructs a shell command using untrusted input from the --workspace option. Because the fallback code path does not sanitize or escape the workspace value, special shell metacharacters (e.g., ;, &&, |) are interpreted by the shell, enabling command injection.
This behavior matches CWE‑78.
Fix
The vulnerability was resolved in [PR #1476], which ensures that workspace values are handled safely and are no longer passed to a subshell in an unsafe manner.
The fix is included in @cyclonedx/cyclonedx-npm version [5.0.0][v5.0.0].
Remediation
- Upgrade to version [5.0.0][v5.0.0] or later, which contains the complete fix.
- As a temporary mitigation for older versions, ensure that the environment variable
npm_execpathis set before invoking the tool. - Avoid passing untrusted or user‑controlled values to the
--workspaceoption.
[v5.0.0]: https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0 [PR #1476]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476
Articles & Coverage 1
Executive ViewAI
@cyclonedx/cyclonedx-npm SBOM generator (versions 2.1.0-4.x) contains a command injection vulnerability (CVSS 8.5) that allows arbitrary code execution when processing untrusted workspace parameters, with no public exploit identified at time of analysis. Organizations relying on this tool for supply chain security risk compromise of build environments and generated software artifacts. Patch availability enables rapid remediation to prevent attackers from executing code with build-process privileges.
Apply vendor patch. If patching is delayed: restrict @cyclonedx/cyclonedx-npm execution to controlled CI/CD environments only; disable dynamic --workspace parameter processing where possible; implement input validation and argument whitelisting at the tool invocation layer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)CVE.org
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB