Product
A command injection vulnerability in @cyclonedx/cyclonedx-npm on Windows allows attackers to execute arbitrary commands by supplying malicious input to the --workspace argument.