https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T17:49:11.591228+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-71538 fkie_cve-2026-71538 2026-10-04T17:49:11.595024+00:00

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace option. When an attacker can influence that option and the fallback npm execution path is reached, shell metacharacters in the workspace value can execute arbitrary operating-system commands with the privileges of the user running the CLI, allowing data access, file modification, or service disruption. This issue is fixed in version 6.0.0.

 https://vulnerability.circl.lu/vuln/ghsa-q69g-4hcv-6jg4 GHSA-q69g-4hcv-6jg4 — @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows 2026-10-04T17:49:11.595156+00:00

Affected: npm: @cyclonedx/cyclonedx-npm

## Summary

A **Windows-specific** command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace <value>` option. User-supplied `--workspace` values can be passed to a shell command without proper neutralization on the Windows fallback execution path, enabling attackers to inject arbitrary OS commands.

The vulnerability was fixed in version [6.0.0][v6.0.0].

## Vulnerability Details

When `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal command execution flow. On **Windows systems**, this path can interpret untrusted `--workspace` input as shell syntax if not safely handled.

As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user.

## Impact

An attacker who can influence the value passed to `--workspace` can execute arbitrary OS commands **on Windows hosts**. This may lead to:

* Arbitrary command execution * Data exfiltration * Local privilege escalation (depending on runtime context and privileges) * Modification or destruction of files accessible to the user running the CLI

The vulnerability affects only scenarios where:

* The user invokes `cyclonedx-npm` with `--workspace <value>`, and * The vulnerable execution path is reached on **Windows**.

## Exploitation Conditions (High-Level)

Exploitation requires the attacker to supply or inf…