@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument
Priority LOW 38CWE-78Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Fixed cyclonedx-node-npm (CycloneDX): 5.0.0@cyclonedx/cyclonedx-npm (npm): 5.0.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CycloneDX | cyclonedx-node-npm | 2.1.0 to before 5.0.0 | 5.0.0 | Patch available | CNA |
| — | @cyclonedx/cyclonedx-npm (npm) | 2.1.0 to before 5.0.0 | 5.0.0 | Patch available | GHSA-v75r-vx73-82pj |
- cyclonedx-node-npm VendorCycloneDX Affected 2.1.0 to before 5.0.0 Fixed in 5.0.0 Patch available CNA
- @cyclonedx/cyclonedx-npm (npm) Vendor— Affected 2.1.0 to before 5.0.0 Fixed in 5.0.0 Patch available GHSA-v75r-vx73-82pj
Remediation
- Fix · CNA cyclonedx-node-npm (CycloneDX) Fixed in 5.0.0
- Fix · GHSA-v75r-vx73-82pj @cyclonedx/cyclonedx-npm (npm) Fixed in 5.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55849
- 2026-10-03 Alias added: GHSA-v75r-vx73-82pj
References
Other 5
- https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj
- https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476
- https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f
- https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0
- https://github.com/CycloneDX/cyclonedx-node-npm
More CycloneDX vulnerabilities
- TI-2024-25631 Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java CVSS 3.1HIGH 7.5
- TI-2024-22686 @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability CVSS 3.1HIGH 8.1
- TI-2025-39908 CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection CVSS 3.1HIGH 7.5
- TI-2026-50119 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows CVSS 4.0HIGH 8.5
- TI-2022-08588 Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server CVSS 3.1HIGH 8.1
Sources
- CVE-2026-55849 · CVE Program
- CVE-2026-55849 · NVD
- FIRST EPSS
- GHSA-v75r-vx73-82pj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences