CVE-2026-55849 Details
Description
@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.
A command injection vulnerability has been identified in the @cyclonedx/cyclonedx-npm package, specifically in versions 2.1.0 prior to 5.0.0. The issue arises when the CLI is used with the --workspace option while the npm_execpath environment variable is unset or empty. In this scenario, user-supplied workspace values are passed to a subshell without proper sanitization, allowing for arbitrary OS command execution with the privileges of the user running the CLI.
Upgrade to version 5.0.0 or later, which addresses the vulnerability by ensuring that workspace values are handled safely and not passed to a subshell in an unsafe manner. As a temporary mitigation for older versions, set the npm_execpath environment variable before invoking the tool, and avoid using untrusted or user-controlled values with the --workspace option.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |