cyclonedx-npm CVE-2026-55849
HIGH
GHSA-v75r-vx73-82pj
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local dev/CI tool so AV:L; a victim must run the CLI with the poisoned argument giving UI:R; attacker needs no prior privileges (PR:N) and command injection yields full C/I/A as the invoking user.
Primary rating from Vendor (https://github.com/CycloneDX/cyclonedx-node-npm).
CVSS VectorVendor: https://github.com/CycloneDX/cyclonedx-node-npm
Lifecycle Timeline
6DescriptionCVE.org
Summary
A command injection vulnerability exists in @cyclonedx/cyclonedx-npm when the CLI is invoked with the --workspace <value> option while the environment variable npm_execpath is unset or empty. User‑supplied --workspace values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands. This issue corresponds to CWE‑78: Improper Neutralization of Special Elements used in an OS Command.
The vulnerability was fixed in version [5.0.0][v5.0.0].
Vulnerability Details
When cyclonedx-npm is executed with the --workspace option, the provided argument is incorporated into an internal shell command. If the environment variable npm_execpath is set, the tool uses the npm executable directly and no injection occurs. However, when npm_execpath is unset or empty, the tool falls back to spawning a subshell and interpolating the --workspace value directly into the command string without proper escaping or neutralization.
As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user.
Impact
An attacker who can influence the value passed to --workspace can execute arbitrary OS commands. This may lead to:
- Arbitrary command execution
- Data exfiltration
- Local privilege escalation (depending on how the tool is used)
- Modification or destruction of files accessible to the user running the CLI
The vulnerability affects only scenarios where:
- The user invokes
cyclonedx-npmwith--workspace <value>, and - The environment variable
npm_execpathis unset or empty
Exploitation Conditions (High‑Level)
Exploitation requires the attacker to supply or influence the --workspace value passed to the CLI. If the tool falls back to its subshell execution path, specially crafted workspace identifiers can cause unintended command execution. No exploit code is included here to avoid providing weaponizable examples.
Root Cause
The CLI constructs a shell command using untrusted input from the --workspace option. Because the fallback code path does not sanitize or escape the workspace value, special shell metacharacters (e.g., ;, &&, |) are interpreted by the shell, enabling command injection.
This behavior matches CWE‑78.
Fix
The vulnerability was resolved in [PR #1476], which ensures that workspace values are handled safely and are no longer passed to a subshell in an unsafe manner.
The fix is included in @cyclonedx/cyclonedx-npm version [5.0.0][v5.0.0].
Remediation
- Upgrade to version [5.0.0][v5.0.0] or later, which contains the complete fix.
- As a temporary mitigation for older versions, ensure that the environment variable
npm_execpathis set before invoking the tool. - Avoid passing untrusted or user‑controlled values to the
--workspaceoption.
[v5.0.0]: https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0 [PR #1476]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476
Articles & Coverage 1
AnalysisAI
Command injection in the @cyclonedx/cyclonedx-npm SBOM generator (versions >= 2.1.0, < 5.0.0) lets an attacker who controls the value passed to the --workspace CLI option execute arbitrary OS commands when the npm_execpath environment variable is unset or empty. In that fallback path the tool spawns a subshell and interpolates the workspace value into a command string without escaping, so shell metacharacters break out of the intended context and run with the invoking user's privileges. No public exploit identified at time of analysis, though the vendor fix PR ships a proof-of-concept-style regression test; the issue is not listed in CISA KEV and no EPSS score was provided.
Technical ContextAI
@cyclonedx/cyclonedx-npm is a Node.js command-line tool that generates CycloneDX Software Bill of Materials (SBOM) documents by querying the npm package manager for a project's dependency tree. The vulnerable logic lives in src/npmRunner.ts, which decides how to invoke npm: when the npm_execpath environment variable is present (as it normally is when the tool is launched via an npm script) it executes npm directly and is safe; when npm_execpath is unset or empty it falls back to execSync('npm ' + args.join(' ')), building a single shell command string from user-supplied arguments including --workspace. Because that string is handed to a shell, the untrusted workspace value is subject to shell interpretation. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CPE pkg:npm/@cyclonedx_cyclonedx-npm confirms the sole affected artifact is the npm package.
RemediationAI
Vendor-released patch: upgrade to @cyclonedx/cyclonedx-npm version 5.0.0 or later, which reworks npm handling to execute npm explicitly rather than through a subshell (a documented BREAKING change per HISTORY.md, so validate your SBOM pipeline after upgrading since npm resolution behavior changed). The fix is in PR #1476 (https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476) with release notes at https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0. As a temporary mitigation for versions that cannot be upgraded, explicitly set the npm_execpath environment variable to a valid npm executable path before every invocation, which forces the safe direct-execution path and avoids the subshell fallback; the trade-off is that this must be enforced consistently across all invocation contexts (CI runners, wrapper scripts, cron) or the vulnerable path can still be reached. Additionally, never pass untrusted or externally-controlled values to the --workspace / -w option, and route affected pipeline owners to the advisory at https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-78 – OS Command Injection
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today