Command Injection in @cyclonedx/cyclonedx-npm via --workspace Argument

The npm package @cyclonedx/cyclonedx-npm is vulnerable to command injection on Windows systems. The vulnerability resides in how the CLI tool handles the --workspace argument. In the tool's fallback execution path, user-supplied input provided to the --workspace flag is passed directly to the system shell without sufficient sanitization or neutralization of shell metacharacters.

An attacker who can control or influence the value passed to the --workspace flag can inject shell metacharacters such as &, |, or > to break out of the intended command context. This allows for the execution of arbitrary OS commands with the privileges of the user running the CLI tool. This vulnerability was addressed in version 6.0.0 by moving away from the vulnerable fallback path and ensuring input is handled safely.

Impact

Successful exploitation allows for arbitrary command execution on the host machine. This can result in data exfiltration, unauthorized modification of files, or elevation of local privileges depending on the user's current environment. The impact is limited to Windows systems where the vulnerable fallback path is reachable.

Recommendation

• Upgrade the @cyclonedx/cyclonedx-npm package to version 6.0.0 or later to apply the fix for CVE-2026-71538.
• Audit build pipelines and development workflows that invoke this tool to ensure that user-supplied input is not being passed to the --workspace argument.
• On Windows, if upgrading is not immediately feasible, restrict the use of the tool to trusted inputs only and consider setting the npm_execpath environment variable to point to a known safe npm-cli.js to potentially bypass the vulnerable fallback path.