Skip to content
OpenAdvisories

Product · CycloneDX

cyclonedx-node-npm

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.5
    CVE-2026-71538

    @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

    @cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, can construct a shell command containing …

    CycloneDX cyclonedx-node-npm @cyclonedx/cyclonedx-npm npm
  • High 8.5
    CVE-2026-55849

    @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument

    @cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary…

    CycloneDX cyclonedx-node-npm @cyclonedx/cyclonedx-npm npm