## Summary A command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace <value>` option while the environment variable `npm_execpath` is unset or empty. User‑supplied `--workspace` values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands. This issue corresponds to **CWE‑78**: Improper Neutralization of Special Elements used in an OS Command. The vulnerability was fixed in version [5.0.0][v5.0.0]. ## Vulnerability Details When `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal shell command. If the environment variable `npm_execpath` is set, the tool uses the npm executable directly and no injection occurs. However, when `npm_execpath` is unset or empty, the tool falls back to spawning a subshell and interpolating the `--workspace` value directly into the command string without proper escaping or neutralization. As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user. ## Impact An attacker who can influence the value passed to `--workspace` can execute arbitrary OS commands. This may lead to: * Arbitrary command execution * Data exfiltration * Local privilege escalation (depending on how the tool is used) * Modification or destruction of files accessible to the user running the CLI The vulnerability affects only scenarios where: * The user invokes `cyclonedx-npm` with `--workspace <value>`, and * The environment variable `npm_execpath` is unset or empty ## Exploitation Conditions (High‑Level) Exploitation requires the attacker to supply or influence the `--workspace` value passed to the CLI. If the tool falls back to its subshell execution path, specially crafted workspace identifiers can cause unintended command execution. No exploit code is included here to avoid providing weaponizable examples. ## Root Cause The CLI constructs a shell command using untrusted input from the `--workspace` option. Because the fallback code path does not sanitize or escape the workspace value, special shell metacharacters (e.g., `;`, `&&`, `|`) are interpreted by the shell, enabling command injection. This behavior matches **CWE‑78**. ## Fix The vulnerability was resolved in [PR #1476], which ensures that workspace values are handled safely and are no longer passed to a subshell in an unsafe manner. The fix is included in `@cyclonedx/cyclonedx-npm` version [5.0.0][v5.0.0]. ## Remediation * Upgrade to version [5.0.0][v5.0.0] or later, which contains the complete fix. * As a temporary mitigation for older versions, ensure that the environment variable `npm_execpath` is set before invoking the tool. * Avoid passing untrusted or user‑controlled values to the `--workspace` option. [v5.0.0]: https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0 [PR #1476]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476
## Summary A command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace <value>` option while the environment variable `npm_execpath` is unset or empty. User‑supplied `--workspace` values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands. This issue corresponds to **CWE‑78**: Improper Neutralization of Special Elements used in an OS Command. The vulnerability was fixed in version [5.0.0][v5.0.0]. ## Vulnerability Details When `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal shell command. If the environment variable `npm_execpath` is set, the tool uses the npm executable directly and no injection occurs. However, when `npm_execpath` is unset or empty, the tool falls back to spawning a subshell and interpolating the `--workspace` value directly into the command string without proper escaping or neutralization. As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user. ## Impact An attacker who can influence the value passed to `--workspace` can execute arbitrary OS commands. This may lead to: * Arbitrary command execution * Data exfiltration * Local privilege escalation (depending on how the tool is used) * Modification or destruction of files accessible to the user running the CLI The vulnerability affects only scenarios where: * The user invokes `cyclonedx-npm` with `--workspace <value>`, and * The environment variable `npm_execpath` is unset or empty ## Exploitation Conditions (High‑Level) Exploitation requires the attacker to supply or influence the `--workspace` value passed to the CLI. If the tool falls back to its subshell execution path, specially crafted workspace identifiers can cause unintended command execution. No exploit code is included here to avoid providing weaponizable examples. ## Root Cause The CLI constructs a shell command using untrusted input from the `--workspace` option. Because the fallback code path does not sanitize or escape the workspace value, special shell metacharacters (e.g., `;`, `&&`, `|`) are interpreted by the shell, enabling command injection. This behavior matches **CWE‑78**. ## Fix The vulnerability was resolved in [PR #1476], which ensures that workspace values are handled safely and are no longer passed to a subshell in an unsafe manner. The fix is included in `@cyclonedx/cyclonedx-npm` version [5.0.0][v5.0.0]. ## Remediation * Upgrade to version [5.0.0][v5.0.0] or later, which contains the complete fix. * As a temporary mitigation for older versions, ensure that the environment variable `npm_execpath` is set before invoking the tool. * Avoid passing untrusted or user‑controlled values to the `--workspace` option. [v5.0.0]: https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0 [PR #1476]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476
Update @cyclonedx/cyclonedx-npm to 5.0.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scan@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument affects @cyclonedx/cyclonedx-npm (npm). Severity is high. ## Summary A command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace <value>` option while the environment variable `npm_execpath` is unset or empty. User‑supplied `--workspace` values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands. This issue corresponds to **CWE‑78**: Improper Neutralization of Special Elements used in an OS Command. The vulnerability was fixed in version [5.0.0][v5.0.0]. ## Vulnerability Details When `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal shell command. If the environment variable `npm_execpath` is set, the tool uses the npm executable directly and no injection occurs. However, when `npm_execpath` is unset or empty, the tool falls back to spawning a subshell and interpolating the `--workspace` value directly into the command string without proper escaping or neutralization. As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user. ## Impact An attacker who can influence the value passed to `--workspace` can execute arbitrary OS commands. This may lead to: * Arbitrary command execution * Data exfiltration * Local privilege escalation (depending on how the tool is used) * Modification or destruction of files accessible to the user running the CLI The vulnerability affects only scenarios where: * The user invokes `cyclonedx-npm` with `--workspace <value>`, and * The environment variable `npm_execpath` is unset or empty ## Exploitation Conditions (High‑Level) Exploitation requires the attacker to supply or influence the `--workspace` value passed to the CLI. If the tool falls back to its subshell execution path, specially crafted workspace identifiers can cause unintended command execution. No exploit code is included here to avoid providing weaponizable examples. ## Root Cause The CLI constructs a shell command using untrusted input from the `--workspace` option. Because the fallback code path does not sanitize or escape the workspace value, special shell metacharacters (e.g., `;`, `&&`, `|`) are interpreted by the shell, enabling command injection. This behavior matches **CWE‑78**. ## Fix The vulnerability was resolved in [PR #1476], which ensures that workspace values are handled safely and are no longer passed to a subshell in an unsafe manner. The fix is included in `@cyclonedx/cyclonedx-npm` version [5.0.0][v5.0.0]. ## Remediation * Upgrade to version [5.0.0][v5.0.0] or later, which contains the complete fix. * As a temporary mitigation for older versions, ensure that the environment variable `npm_execpath` is set before invoking the tool. * Avoid passing untrusted or user‑controlled values to the `--workspace` option. [v5.0.0]: https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0 [PR #1476]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476
AI coding agents often install or upgrade packages automatically in npm. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| @cyclonedx/cyclonedx-npmnpm | >=2.1.0,<5.0.0 | 5.0.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate @cyclonedx/cyclonedx-npm to 5.0.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scan@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument affects @cyclonedx/cyclonedx-npm (npm). Severity is high. ## Summary A command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace <value>` option while the environment variable `npm_execpath` is unset or empty. User‑supplied `--workspace` values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands. This issue corresponds to **CWE‑78**: Improper Neutralization of Special Elements used in an OS Command. The vulnerability was fixed in version [5.0.0][v5.0.0]. ## Vulnerability Details When `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal shell command. If the environment variable `npm_execpath` is set, the tool uses the npm executable directly and no injection occurs. However, when `npm_execpath` is unset or empty, the tool falls back to spawning a subshell and interpolating the `--workspace` value directly into the command string without proper escaping or neutralization. As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user. ## Impact An attacker who can influence the value passed to `--workspace` can execute arbitrary OS commands. This may lead to: * Arbitrary command execution * Data exfiltration * Local privilege escalation (depending on how the tool is used) * Modification or destruction of files accessible to the user running the CLI The vulnerability affects only scenarios where: * The user invokes `cyclonedx-npm` with `--workspace <value>`, and * The environment variable `npm_execpath` is unset or empty ## Exploitation Conditions (High‑Level) Exploitation requires the attacker to supply or influence the `--workspace` value passed to the CLI. If the tool falls back to its subshell execution path, specially crafted workspace identifiers can cause unintended command execution. No exploit code is included here to avoid providing weaponizable examples. ## Root Cause The CLI constructs a shell command using untrusted input from the `--workspace` option. Because the fallback code path does not sanitize or escape the workspace value, special shell metacharacters (e.g., `;`, `&&`, `|`) are interpreted by the shell, enabling command injection. This behavior matches **CWE‑78**. ## Fix The vulnerability was resolved in [PR #1476], which ensures that workspace values are handled safely and are no longer passed to a subshell in an unsafe manner. The fix is included in `@cyclonedx/cyclonedx-npm` version [5.0.0][v5.0.0]. ## Remediation * Upgrade to version [5.0.0][v5.0.0] or later, which contains the complete fix. * As a temporary mitigation for older versions, ensure that the environment variable `npm_execpath` is set before invoking the tool. * Avoid passing untrusted or user‑controlled values to the `--workspace` option. [v5.0.0]: https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0 [PR #1476]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476
AI coding agents often install or upgrade packages automatically in npm. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| @cyclonedx/cyclonedx-npmnpm | >=2.1.0,<5.0.0 | 5.0.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard