Cyclonedx Node Npm
Monthly
Command injection in the @cyclonedx/cyclonedx-npm CLI (versions before 6.0.0) lets an attacker who controls the value passed to the --workspace option run arbitrary operating-system commands on Windows hosts, with the privileges of the user invoking the tool. Exploitation is narrowly gated: the host must be Windows, the CLI must be invoked with --workspace, and the vulnerable Windows fallback npm-execution path in src/npmRunner.ts must be reached, which only occurs when the npm_execpath environment variable does not already point at the npm CLI. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows local attack, no privileges required, but user interaction is needed, so the realistic scenario is a CI/CD or scripted pipeline that feeds untrusted data into --workspace; no public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw is fixed in version 6.0.0.
Command injection in the @cyclonedx/cyclonedx-npm CLI (versions before 6.0.0) lets an attacker who controls the value passed to the --workspace option run arbitrary operating-system commands on Windows hosts, with the privileges of the user invoking the tool. Exploitation is narrowly gated: the host must be Windows, the CLI must be invoked with --workspace, and the vulnerable Windows fallback npm-execution path in src/npmRunner.ts must be reached, which only occurs when the npm_execpath environment variable does not already point at the npm CLI. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows local attack, no privileges required, but user interaction is needed, so the realistic scenario is a CI/CD or scripted pipeline that feeds untrusted data into --workspace; no public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw is fixed in version 6.0.0.