CVE-2026-71538

Name of the Vulnerable Software and Affected Versions @cyclonedx/cyclonedx-npm versions prior to 6.0.0

Description A command injection issue exists on Windows systems when the CLI is used with the --workspace option. In the fallback path within src/npmRunner.ts (triggered when npm execpath does not provide the npm CLI path), the tool constructs a shell command using the untrusted value from the --workspace option without proper neutralization. An attacker capable of influencing this value can use shell metacharacters to execute arbitrary operating-system commands with the privileges of the user running the CLI, potentially leading to data access, file modification, or service disruption.

Recommendations Update to version 6.0.0 or later. As a temporary mitigation, ensure the npm execpath environment variable is set to npm-cli.js before invoking the tool. Avoid passing untrusted or user-controlled values to the --workspace option.