CVE-2026-55849

Name of the Vulnerable Software and Affected Versions @cyclonedx/cyclonedx-npm versions 2.1.0 through 4.x

Description Command injection occurs when the CLI is invoked with the --workspace option while the environment variable npm execpath is unset or empty. In this scenario, user-supplied values for the --workspace parameter are passed to a subshell without proper sanitization, allowing the execution of arbitrary OS commands with the privileges of the invoking user. This happens because the tool falls back to spawning a subshell and interpolates the input directly into the command string, allowing shell metacharacters to be interpreted.

Recommendations Update to version 5.0.0 or later. Ensure the npm execpath environment variable is set before invoking the tool. Avoid passing untrusted or user-controlled values to the --workspace parameter.