https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 17:49:09 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-71538 <p>@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace option. When an attacker can influence that option and the fallback npm execution path is reached, shell metacharacters in the workspace value can execute arbitrary operating-system commands with the privileges of the user running the CLI, allowing data access, file modification, or service disruption. This issue is fixed in version 6.0.0.</p> <p>@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace option. When an attacker can influence that option and the fallback npm execution path is reached, shell metacharacters in the workspace value can execute arbitrary operating-system commands with the privileges of the user running the CLI, allowing data access, file modification, or service disruption. This issue is fixed in version 6.0.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-71538 https://vulnerability.circl.lu/vuln/ghsa-q69g-4hcv-6jg4 <p><strong>Affected:</strong> npm: @cyclonedx/cyclonedx-npm</p> <p>## Summary</p> <p>A **Windows-specific** command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace &lt;value&gt;` option. User-supplied `--workspace` values can be passed to a shell command without proper neutralization on the Windows fallback execution path, enabling attackers to inject arbitrary OS commands.</p> <p>The vulnerability was fixed in version [6.0.0][v6.0.0].</p> <p>## Vulnerability Details</p> <p>When `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal command execution flow. On **Windows systems**, this path can interpret untrusted `--workspace` input as shell syntax if not safely handled.</p> <p>As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user.</p> <p>## Impact</p> <p>An attacker who can influence the value passed to `--workspace` can execute arbitrary OS commands **on Windows hosts**. This may lead to:</p> <p>* Arbitrary command execution * Data exfiltration * Local privilege escalation (depending on runtime context and privileges) * Modification or destruction of files accessible to the user running the CLI</p> <p>The vulnerability affects only scenarios where:</p> <p>* The user invokes `cyclonedx-npm` with `--workspace &lt;value&gt;`, and * The vulnerable execution path is reached on **Windows**.</p> <p>## Exploitation Conditions (High-Level)</p> <p>Exploitation requires the attacker to supply or inf…</p> <p><strong>Affected:</strong> npm: @cyclonedx/cyclonedx-npm</p> <p>## Summary</p> <p>A **Windows-specific** command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace &lt;value&gt;` option. User-supplied `--workspace` values can be passed to a shell command without proper neutralization on the Windows fallback execution path, enabling attackers to inject arbitrary OS commands.</p> <p>The vulnerability was fixed in version [6.0.0][v6.0.0].</p> <p>## Vulnerability Details</p> <p>When `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal command execution flow. On **Windows systems**, this path can interpret untrusted `--workspace` input as shell syntax if not safely handled.</p> <p>As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user.</p> <p>## Impact</p> <p>An attacker who can influence the value passed to `--workspace` can execute arbitrary OS commands **on Windows hosts**. This may lead to:</p> <p>* Arbitrary command execution * Data exfiltration * Local privilege escalation (depending on runtime context and privileges) * Modification or destruction of files accessible to the user running the CLI</p> <p>The vulnerability affects only scenarios where:</p> <p>* The user invokes `cyclonedx-npm` with `--workspace &lt;value&gt;`, and * The vulnerable execution path is reached on **Windows**.</p> <p>## Exploitation Conditions (High-Level)</p> <p>Exploitation requires the attacker to supply or inf…</p> https://vulnerability.circl.lu/vuln/ghsa-q69g-4hcv-6jg4