@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace option. When an attacker can influence that option and the fallback npm execution path is reached, shell metacharacters in the workspace value can execute arbitrary operating-system commands with the privileges of the user running the CLI, allowing data access, file modification, or service disruption. This issue is fixed in version 6.0.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CycloneDX | cyclonedx-node-npm | before 6.0.0 | 6.0.0 | Patch available | CNA |
| — | @cyclonedx/cyclonedx-npm (npm) | before 6.0.0 | 6.0.0 | Patch available | GHSA-q69g-4hcv-6jg4 |
- cyclonedx-node-npm VendorCycloneDX Affected before 6.0.0 Fixed in 6.0.0 Patch available CNA
- @cyclonedx/cyclonedx-npm (npm) Vendor— Affected before 6.0.0 Fixed in 6.0.0 Patch available GHSA-q69g-4hcv-6jg4
Remediation
- Fix · CNA cyclonedx-node-npm (CycloneDX) Fixed in 6.0.0
- Fix · GHSA-q69g-4hcv-6jg4 @cyclonedx/cyclonedx-npm (npm) Fixed in 6.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-71538
- 2026-10-03 Alias added: GHSA-q69g-4hcv-6jg4
References
Other 5
- https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-q69g-4hcv-6jg4
- https://github.com/CycloneDX/cyclonedx-node-npm/pull/1489
- https://github.com/CycloneDX/cyclonedx-node-npm/commit/15d3beb5bcd2b0b6eccfdf31192f5103b3f12c0f
- https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v6.0.0
- https://github.com/CycloneDX/cyclonedx-node-npm
More CycloneDX vulnerabilities
- TI-2024-25631 Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java CVSS 3.1HIGH 7.5
- TI-2024-22686 @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability CVSS 3.1HIGH 8.1
- TI-2025-39908 CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection CVSS 3.1HIGH 7.5
- TI-2026-40311 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument CVSS 4.0HIGH 8.5
- TI-2022-08588 Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server CVSS 3.1HIGH 8.1
Sources
- CVE-2026-71538 · CVE Program
- CVE-2026-71538 · NVD
- FIRST EPSS
- GHSA-q69g-4hcv-6jg4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences