CVE-2026-55849

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npmexecpath is unset or empty, allowing arbitrary OS command execution with the privileg...

CVE-2026-55849

The CVE affects @cyclonedx/cyclonedx-npm: from 2.1.0 up to 5.0.0, the CLI passes user-supplied --workspace values to a subshell when npm_execpath is unset or empty, enabling arbitrary OS command execution with the invoking user’s privileges. Root cause is unsanitized input used in a shell command...

CVE-2026-55849

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npmexecpath is unset or empty, allowing arbitrary OS command execution with the privileg...

CVE-2026-55849 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npmexecpath is unset or empty, allowing arbitrary OS command execution with the privileg...

@ajna-inc/npmvc (>=0.1.0, <=0.3.4), @cra-ready/cli (>=0.1.0, <=0.1.1) +3 more potentially affected by CVE-2026-55849 via @cyclonedx/cyclonedx-npm (>=3.1.0, <=4.2.1)

@cyclonedx/cyclonedx-npm NPM version =3.1.0, =0.1.0, =0.1.0, =1.0.8, =1.1.3 - @raj-dev/guardrail 1.0.0 - flatlock 1.2.0 Source cves: CVE-2026-55849 Source advisory: OSV:GHSA-V75R-VX73-82PJ...

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument

Summary A command injection vulnerability exists in @cyclonedx/cyclonedx-npm when the CLI is invoked with the --workspace option while the environment variable npmexecpath is unset or empty. User‑supplied --workspace values are passed to a subshell without proper sanitization, enabling attackers ...

@ajna-inc/npmvc (>=0.1.0, <=0.3.4), @cra-ready/cli (>=0.1.0, <=0.1.1) +3 more potentially affected by CVE-2026-55849 via @cyclonedx/cyclonedx-npm (>=3.1.0, <=4.2.1)

@cyclonedx/cyclonedx-npm NPM version =3.1.0, =0.1.0, =0.1.0, =1.0.8, =1.1.3 - @raj-dev/guardrail 1.0.0 - flatlock 1.2.0 Source cves: CVE-2026-55849 Source advisory: SNYK:JS-CYCLONEDXCYCLONEDXNPM-17817903...

PT-2026-51119

Name of the Vulnerable Software and Affected Versions @cyclonedx/cyclonedx-npm versions 2.1.0 through 4.x Description Command injection occurs when the CLI is invoked with the --workspace option while the environment variable npm execpath is unset or empty. In this scenario, user-supplied values...