CVE-2026-55849CWE-78

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument

High · published July 8, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
13.7
In the wild
Unconfirmed
What it is

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00235 · 13.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-08T21:10Z
EPSS history
Timeline
  • 08 JUL 21:10Z
    @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument
    cvelistv5