Go to packages list

cyclonedx-cyclonedx-npm

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 2HighAffects 2 versions
  • 0MediumAffects 0 versions
  • 0ModerateAffects 0 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
2vulnerabilities
  • Critical0 (0.0%)
  • High2 (100.0%)
  • Medium0 (0.0%)
  • Moderate0 (0.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (2)

Known vulnerabilities affecting cyclonedx-cyclonedx-npm, based on data from OSV.

Vulnerabilities affecting cyclonedx-cyclonedx-npm
IDSeveritySummaryAffected versionsPublishedSource
GHSA-q69g-4hcv-6jg4High@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows## Summary A **Windows-specific** command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace <value>` option. User-supplied `--workspace` values can be passed to a shell command without proper neutralization on the Windows fallback execution path, enabling attackers to inject arbitrary OS commands. The vulnerability was fixed in version [6.0.0][v6.0.0]. ## Vulnerability Details When `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal command execution flow. On **Windo
  • < 6.0.0
GitHub (opens in a new tab)
GHSA-v75r-vx73-82pjHigh@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument## Summary A command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace <value>` option while the environment variable `npm_execpath` is unset or empty. User‑supplied `--workspace` values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands. This issue corresponds to **CWE‑78**: Improper Neutralization of Special Elements used in an OS Command. The vulnerability was fixed in version [5.0.0][v5.0.0]. ## Vulnerability Details When `cyclonedx-npm` is executed with the `--workspace` o
  • >= 2.1.0, < 5.0.0
GitHub (opens in a new tab)
  • GHSA-q69g-4hcv-6jg4High
    @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
    • < 6.0.0
    GitHub (opens in a new tab)

    ## Summary A **Windows-specific** command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace <value>` option. User-supplied `--workspace` values can be passed to a shell command without proper neutralization on the Windows fallback execution path, enabling attackers to inject arbitrary OS commands. The vulnerability was fixed in version [6.0.0][v6.0.0]. ## Vulnerability Details When `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal command execution flow. On **Windo

    CVE: CVE-2026-71538

  • GHSA-v75r-vx73-82pjHigh
    @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument
    • >= 2.1.0, < 5.0.0
    GitHub (opens in a new tab)

    ## Summary A command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace <value>` option while the environment variable `npm_execpath` is unset or empty. User‑supplied `--workspace` values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands. This issue corresponds to **CWE‑78**: Improper Neutralization of Special Elements used in an OS Command. The vulnerability was fixed in version [5.0.0][v5.0.0]. ## Vulnerability Details When `cyclonedx-npm` is executed with the `--workspace` o

    CVE: CVE-2026-55849

Showing 1-2 of 2 vulnerabilities