https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 01:54:04 +0000 https://vulnerability.circl.lu/vuln/brew-cyclonedx-npm-cve-2026-55849 <p><strong>Affected:</strong> Homebrew: cyclonedx-npm</p> <p>@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.</p> <p><strong>Affected:</strong> Homebrew: cyclonedx-npm</p> <p>@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.</p> https://vulnerability.circl.lu/vuln/brew-cyclonedx-npm-cve-2026-55849 https://vulnerability.circl.lu/vuln/fkie_cve-2026-55849 <p>@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.</p> <p>@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-55849 https://vulnerability.circl.lu/vuln/ghsa-v75r-vx73-82pj <p><strong>Affected:</strong> npm: @cyclonedx/cyclonedx-npm</p> <p>## Summary A command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace &lt;value&gt;` option while the environment variable `npm_execpath` is unset or empty. User‑supplied `--workspace` values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands. This issue corresponds to **CWE‑78**: Improper Neutralization of Special Elements used in an OS Command.</p> <p>The vulnerability was fixed in version [5.0.0][v5.0.0].</p> <p>## Vulnerability Details</p> <p>When `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal shell command. If the environment variable `npm_execpath` is set, the tool uses the npm executable directly and no injection occurs. However, when `npm_execpath` is unset or empty, the tool falls back to spawning a subshell and interpolating the `--workspace` value directly into the command string without proper escaping or neutralization.</p> <p>As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user.</p> <p>## Impact</p> <p>An attacker who can influence the value passed to `--workspace` can execute arbitrary OS commands. This may lead to:</p> <p>* Arbitrary command execution * Data exfiltration * Local privilege escalation (depending on how the tool is used) * Modification or destruction of files accessible to the user running the CLI…</p> <p><strong>Affected:</strong> npm: @cyclonedx/cyclonedx-npm</p> <p>## Summary A command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace &lt;value&gt;` option while the environment variable `npm_execpath` is unset or empty. User‑supplied `--workspace` values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands. This issue corresponds to **CWE‑78**: Improper Neutralization of Special Elements used in an OS Command.</p> <p>The vulnerability was fixed in version [5.0.0][v5.0.0].</p> <p>## Vulnerability Details</p> <p>When `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal shell command. If the environment variable `npm_execpath` is set, the tool uses the npm executable directly and no injection occurs. However, when `npm_execpath` is unset or empty, the tool falls back to spawning a subshell and interpolating the `--workspace` value directly into the command string without proper escaping or neutralization.</p> <p>As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user.</p> <p>## Impact</p> <p>An attacker who can influence the value passed to `--workspace` can execute arbitrary OS commands. This may lead to:</p> <p>* Arbitrary command execution * Data exfiltration * Local privilege escalation (depending on how the tool is used) * Modification or destruction of files accessible to the user running the CLI…</p> https://vulnerability.circl.lu/vuln/ghsa-v75r-vx73-82pj