CVE-2026-57998

Name of the Vulnerable Software and Affected Versions better-npm-audit versions 3.x through 3.11.0 better-npm-audit version 4.0.0-rc.2

Description The software constructs an npm audit command by interpolating the user-supplied --registry option into a command string within src/handlers/handleInput.ts without proper validation or quoting. This string is subsequently passed to the child process.exec() function in index.ts, which spawns a shell. An attacker can provide a registry value containing shell metacharacters, such as semicolons, pipes, or command substitution, to execute arbitrary operating system commands with the privileges of the process running the audit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.