Vulnerabilities

TI-2026-50119 CVE-2026-71538 · GHSA-q69g-4hcv-6jg4

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

LOW 38

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00212 Published 2026-09-17 Fixed in 6.0.0 CWE-78

TI-2026-40311 CVE-2026-55849 · GHSA-v75r-vx73-82pj

LOW 38

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00235 Published 2026-07-08 Fixed in 5.0.0 CWE-78

TI-2025-39908 CVE-2025-64518 · GHSA-6fhj-vr9j-g45r

LOW 39

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00394 Published 2025-11-10 Partial fix · 11.0.1 CWE-611

TI-2024-25631 CVE-2024-38374 · GHSA-683x-4444-jxh8

HIGH 72

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00589 Published 2024-06-28 Partial fix · 9.0.4 CWE-611

TI-2024-22686 CVE-2024-34345 · GHSA-38gf-rh2w-gmj7

HIGH 70

The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00925 Published 2024-05-09 Fixed in 6.7.1 CWE-611

TI-2022-08588 CVE-2022-24774

LOW 38

CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01451 Published 2022-03-22 Fixed in 2.0.1 CWE-20