Command Injection in better-npm-audit via --registry Parameter

The better-npm-audit package (versions through 3.11.0 and 4.0.0-rc.2) contains a critical command injection vulnerability identified as CVE-2026-57998. The vulnerability originates in src/handlers/handleInput.ts, where user-supplied input provided via the --registry command-line option is directly interpolated into a command string without sufficient validation or quoting. This string is subsequently passed to child_process.exec() in index.ts, which triggers a shell-based execution context. By supplying shell metacharacters such as semicolons, pipes, or command substitution sequences, an attacker can execute arbitrary operating system commands. The injected commands run with the privileges of the user executing the audit process, which may include build agents or developer environments, posing a significant risk to CI/CD pipelines and local workstations.

Impact

Successful exploitation allows for arbitrary code execution in the context of the user or process running the better-npm-audit tool. This can lead to full compromise of the local environment, exfiltration of credentials or source code, and persistent access to CI/CD systems, potentially facilitating supply chain compromise if injected into automated pipelines.

Recommendation

• Upgrade better-npm-audit to a patched version that sanitizes the --registry input or switches from child_process.exec() to child_process.execFile() to avoid shell interpretation.
• Audit build logs and automated CI/CD pipeline configurations to detect suspicious usage of the --registry parameter containing shell metacharacters like ";", "|", "&", or "$".
• Limit the privileges of service accounts running audit tools in CI/CD environments to minimize the impact of successful command injection.