TI-2026-41760 CVE-2026-57998 · GHSA-f8p4-pxm9-xwx5
better-npm-audit OS Command Injection via registry flag
Priority HIGH 72
better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or…