Vulnerability-Lookup

CVE-2026-55849 (GCVE-0-2026-55849)

Vulnerability from cvelistv5 – Published: 2026-07-08 21:10 – Updated: 2026-07-09 19:36

Title

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument

Summary

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 19:36 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/CycloneDX/cyclonedx-node-npm/s…	x_refsource_CONFIRM
https://github.com/CycloneDX/cyclonedx-node-npm/p…	x_refsource_MISC
https://github.com/CycloneDX/cyclonedx-node-npm/c…	x_refsource_MISC
https://github.com/CycloneDX/cyclonedx-node-npm/r…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
CycloneDX	cyclonedx-node-npm	Affected: >= 2.1.0, < 5.0.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55849",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T19:36:34.180471Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T19:36:40.011Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cyclonedx-node-npm",
          "vendor": "CycloneDX",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 5.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T21:10:15.798Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj"
        },
        {
          "name": "https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476"
        },
        {
          "name": "https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f"
        },
        {
          "name": "https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-v75r-vx73-82pj",
        "discovery": "UNKNOWN"
      },
      "title": "@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55849",
    "datePublished": "2026-07-08T21:10:15.798Z",
    "dateReserved": "2026-06-17T16:44:40.994Z",
    "dateUpdated": "2026-07-09T19:36:40.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55849",
      "date": "2026-09-23",
      "epss": "0.00235",
      "percentile": "0.14796"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "cyclonedx-node-npm",
                "vendor": "CycloneDX",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2.1.0, \u003c 5.0.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0."
          }
        ],
        "id": "CVE-2026-55849",
        "lastModified": "2026-07-10T19:15:21.853",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-55849",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T19:36:34.180471Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-08T22:17:15.783",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-78"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55849",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T19:36:34.180471Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T19:36:36.494Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "cyclonedx-node-npm",
              "vendor": "CycloneDX",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 2.1.0, \u003c 5.0.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "PASSIVE",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-78",
                  "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T21:10:15.798Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj"
            },
            {
              "name": "https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476"
            },
            {
              "name": "https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f"
            },
            {
              "name": "https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0"
            }
          ],
          "source": {
            "advisory": "GHSA-v75r-vx73-82pj",
            "discovery": "UNKNOWN"
          },
          "title": "@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-55849",
        "datePublished": "2026-07-08T21:10:15.798Z",
        "dateReserved": "2026-06-17T16:44:40.994Z",
        "dateUpdated": "2026-07-08T21:10:15.798Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BREW-CYCLONEDX-NPM-CVE-2… (CVE-2026-55849)

Vulnerability from osv_homebrew – Published: 2026-08-13 16:42 – Updated: 2026-08-13 16:42 – Source website

Summary

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument

Details

Severity

8.5 (High)


                    
                      CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

URL

Type

	https://github.com/CycloneDX/cyclonedx-node-npm/r…	WEB
	https://github.com/CVEProject/cvelistV5/tree/main…	ADVISORY
	https://github.com/CycloneDX/cyclonedx-node-npm/s…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-55849	ADVISORY
	https://github.com/CycloneDX/cyclonedx-node-npm/c…	FIX
	https://github.com/CycloneDX/cyclonedx-node-npm/p…	FIX

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "5.0.0"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "cyclonedx-npm",
        "purl": "pkg:brew/cyclonedx-npm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "git",
    "upstream_evidence": [
      {
        "ecosystem": "GIT",
        "key": "https://github.com/cyclonedx/cyclonedx-node-npm",
        "name": "https://github.com/cyclonedx/cyclonedx-node-npm",
        "strategy": "git",
        "subject_version": "6.0.1"
      },
      {
        "ecosystem": "npm",
        "key": "pkg:npm/%40cyclonedx/cyclonedx-npm@6.0.1",
        "name": "@cyclonedx/cyclonedx-npm",
        "strategy": "registry",
        "subject_version": "6.0.1"
      }
    ]
  },
  "details": "@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.",
  "id": "BREW-cyclonedx-npm-CVE-2026-55849",
  "modified": "2026-08-13T16:42:07Z",
  "published": "2026-08-13T16:42:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55849.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55849"
    },
    {
      "type": "FIX",
      "url": "https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f"
    },
    {
      "type": "FIX",
      "url": "https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument",
  "upstream": [
    "CVE-2026-55849",
    "GHSA-v75r-vx73-82pj"
  ]
}

FKIE_CVE-2026-55849

Vulnerability from fkie_nvd - Published: 2026-07-08 22:17 - Updated: 2026-07-10 19:15

Severity

8.5 (High) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f
	security-advisories@github.com	https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476
	security-advisories@github.com	https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0
	security-advisories@github.com	https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "cyclonedx-node-npm",
          "vendor": "CycloneDX",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 5.0.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0."
    }
  ],
  "id": "CVE-2026-55849",
  "lastModified": "2026-07-10T19:15:21.853",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55849",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-09T19:36:34.180471Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-08T22:17:15.783",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-V75R-VX73-82PJ

Vulnerability from github – Published: 2026-06-19 20:47 – Updated: 2026-06-19 20:47

Summary

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument

Details

Summary

A command injection vulnerability exists in @cyclonedx/cyclonedx-npm when the CLI is invoked with the --workspace <value> option while the environment variable npm_execpath is unset or empty.
User‑supplied --workspace values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands.
This issue corresponds to CWE‑78: Improper Neutralization of Special Elements used in an OS Command.

The vulnerability was fixed in version 5.0.0.

Vulnerability Details

When cyclonedx-npm is executed with the --workspace option, the provided argument is incorporated into an internal shell command.
If the environment variable npm_execpath is set, the tool uses the npm executable directly and no injection occurs.
However, when npm_execpath is unset or empty, the tool falls back to spawning a subshell and interpolating the --workspace value directly into the command string without proper escaping or neutralization.

As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user.

Impact

An attacker who can influence the value passed to --workspace can execute arbitrary OS commands.
This may lead to:

Arbitrary command execution
Data exfiltration
Local privilege escalation (depending on how the tool is used)
Modification or destruction of files accessible to the user running the CLI

The vulnerability affects only scenarios where: * The user invokes cyclonedx-npm with --workspace <value>, and * The environment variable npm_execpath is unset or empty

Exploitation Conditions (High‑Level)

Exploitation requires the attacker to supply or influence the --workspace value passed to the CLI.
If the tool falls back to its subshell execution path, specially crafted workspace identifiers can cause unintended command execution.
No exploit code is included here to avoid providing weaponizable examples.

Root Cause

The CLI constructs a shell command using untrusted input from the --workspace option.
Because the fallback code path does not sanitize or escape the workspace value, special shell metacharacters (e.g., ;, &&, |) are interpreted by the shell, enabling command injection.

This behavior matches CWE‑78.

Fix

The vulnerability was resolved in PR #1476, which ensures that workspace values are handled safely and are no longer passed to a subshell in an unsafe manner.

The fix is included in @cyclonedx/cyclonedx-npm version 5.0.0.

Remediation

Upgrade to version 5.0.0 or later, which contains the complete fix.
As a temporary mitigation for older versions, ensure that the environment variable npm_execpath is set before invoking the tool.
Avoid passing untrusted or user‑controlled values to the --workspace option.

Severity

8.5 (High)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@cyclonedx/cyclonedx-npm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0"
            },
            {
              "fixed": "5.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55849"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T20:47:48Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\nA command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace \u003cvalue\u003e` option while the environment variable `npm_execpath` is unset or empty.  \nUser\u2011supplied `--workspace` values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands.  \nThis issue corresponds to **CWE\u201178**: Improper Neutralization of Special Elements used in an OS Command.\n\nThe vulnerability was fixed in version [5.0.0][v5.0.0].\n\n## Vulnerability Details\n\nWhen `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal shell command.  \nIf the environment variable `npm_execpath` is set, the tool uses the npm executable directly and no injection occurs.  \nHowever, when `npm_execpath` is unset or empty, the tool falls back to spawning a subshell and interpolating the `--workspace` value directly into the command string without proper escaping or neutralization.\n\nAs a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user.\n\n## Impact\n\nAn attacker who can influence the value passed to `--workspace` can execute arbitrary OS commands.  \nThis may lead to:\n\n* Arbitrary command execution\n* Data exfiltration\n* Local privilege escalation (depending on how the tool is used)\n* Modification or destruction of files accessible to the user running the CLI\n\nThe vulnerability affects only scenarios where:\n* The user invokes `cyclonedx-npm` with `--workspace \u003cvalue\u003e`, and\n* The environment variable `npm_execpath` is unset or empty\n\n## Exploitation Conditions (High\u2011Level)\n\nExploitation requires the attacker to supply or influence the `--workspace` value passed to the CLI.  \nIf the tool falls back to its subshell execution path, specially crafted workspace identifiers can cause unintended command execution.  \nNo exploit code is included here to avoid providing weaponizable examples.\n\n## Root Cause\n\nThe CLI constructs a shell command using untrusted input from the `--workspace` option.  \nBecause the fallback code path does not sanitize or escape the workspace value, special shell metacharacters (e.g., `;`, `\u0026\u0026`, `|`) are interpreted by the shell, enabling command injection.\n\nThis behavior matches **CWE\u201178**.\n\n## Fix\n\nThe vulnerability was resolved in [PR #1476], which ensures that workspace values are handled safely and are no longer passed to a subshell in an unsafe manner.\n\nThe fix is included in `@cyclonedx/cyclonedx-npm` version [5.0.0][v5.0.0].\n\n## Remediation\n\n* Upgrade to version [5.0.0][v5.0.0] or later, which contains the complete fix.\n* As a temporary mitigation for older versions, ensure that the environment variable `npm_execpath` is set before invoking the tool.\n* Avoid passing untrusted or user\u2011controlled values to the `--workspace` option.\n\n[v5.0.0]: https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0\n[PR #1476]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476",
  "id": "GHSA-v75r-vx73-82pj",
  "modified": "2026-06-19T20:47:48Z",
  "published": "2026-06-19T20:47:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/CycloneDX/cyclonedx-node-npm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55849 (GCVE-0-2026-55849)

BREW-CYCLONEDX-NPM-CVE-2… (CVE-2026-55849)

FKIE_CVE-2026-55849

GHSA-V75R-VX73-82PJ

Summary

Vulnerability Details

Impact

Exploitation Conditions (High‑Level)

Root Cause

Fix

Remediation

Tags

Sightings

Nomenclature

Related by attack behaviour