Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A Windows-specific command injection vulnerability exists in @cyclonedx/cyclonedx-npm when the CLI is invoked with the --workspace <value option. User-supplied --workspace values can be passed to a shell command without proper neutralization on the Windows fallback execution path, enabling attackers to inject arbitrary OS commands. The vulnerability was fixed in version [6.0.0][v6.0.0]. Vulnerability Details When cyclonedx-npm is executed with the --workspace option, the provided argument is incorporated into an internal command execution flow. On Windows systems, this path can interpret untrusted --workspace input as shell syntax if not safely handled. As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user. Impact An attacker who can influence the value passed to --workspace can execute arbitrary OS commands on Windows hosts. This may lead to: Arbitrary command…
Recommended action: Upgrade to 6.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A command injection vulnerability exists in @cyclonedx/cyclonedx-npm when the CLI is invoked with the --workspace <value option while the environment variable npmexecpath is unset or empty. User‑supplied --workspace values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands. This issue corresponds to CWE‑78: Improper Neutralization of Special Elements used in an OS Command. The vulnerability was fixed in version [5.0.0][v5.0.0]. Vulnerability Details When cyclonedx-npm is executed with the --workspace option, the provided argument is incorporated into an internal shell command. If the environment variable npmexecpath is set, the tool uses the npm executable directly and no injection occurs. However, when npmexecpath is unset or empty, the tool falls back to spawning a subshell and interpolating the --workspace value directly into the command string without proper escaping or neutralization. As a result, specially crafted…
Recommended action: Upgrade to 5.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.