@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument (CVE-2026-55849) | HOL Guard CVE