Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M

CVE-2026-55849@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument

High 8.5

In plain English

A high-severity OS command injection in cyclonedx-node-npm from CycloneDX. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)0.2%top 85.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@cyclonedx/cyclonedx-npm	5.0.0	GHSA-v75r-vx73-82pj

Affected products (as reported)

Vendor	Product	Versions
CycloneDX	cyclonedx-node-npm	>= 2.1.0, < 5.0.0

Weakness: CWE-78 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj x_refsource_CONFIRM
https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476 x_refsource_MISC
https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f x_refsource_MISC
https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0 x_refsource_MISC