CVE-2026-71538

10th percentile - higher than 10% of all known CVEs

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace option. When an attacker can influence that option and the fallback npm execution path is reached, shell metacharacters in the workspace value can execute arbitrary operating-system commands with the privileges of the user running the CLI, allowing data access, file modification, or service disruption. This issue is fixed in version 6.0.0.

Possible execution of arbitrary operating-system commands with the privileges of the CLI user, potentially leading to data theft, file modification, or service disruption.

Update @cyclonedx/cyclonedx-npm to version 6.0.0 or later and avoid passing untrusted values in the --workspace option.