https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-05T01:53:59.628643+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/brew-cyclonedx-npm-cve-2026-55849 BREW-cyclonedx-npm-CVE-2026-55849 — @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument 2026-10-05T01:53:59.665866+00:00

Affected: Homebrew: cyclonedx-npm

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.

 https://vulnerability.circl.lu/vuln/fkie_cve-2026-55849 fkie_cve-2026-55849 2026-10-05T01:53:59.665951+00:00

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.

 https://vulnerability.circl.lu/vuln/ghsa-v75r-vx73-82pj GHSA-v75r-vx73-82pj — @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument 2026-10-05T01:53:59.665996+00:00

Affected: npm: @cyclonedx/cyclonedx-npm

## Summary A command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace <value>` option while the environment variable `npm_execpath` is unset or empty. User‑supplied `--workspace` values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands. This issue corresponds to **CWE‑78**: Improper Neutralization of Special Elements used in an OS Command.

The vulnerability was fixed in version [5.0.0][v5.0.0].

## Vulnerability Details

When `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal shell command. If the environment variable `npm_execpath` is set, the tool uses the npm executable directly and no injection occurs. However, when `npm_execpath` is unset or empty, the tool falls back to spawning a subshell and interpolating the `--workspace` value directly into the command string without proper escaping or neutralization.

As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user.

## Impact

An attacker who can influence the value passed to `--workspace` can execute arbitrary OS commands. This may lead to:

* Arbitrary command execution * Data exfiltration * Local privilege escalation (depending on how the tool is used) * Modification or destruction of files accessible to the user running the CLI…