Executive brief
@jswork/next-npm-version is an NPM package used to retrieve version information for other NPM packages. The package fails to sanitize user-supplied input before passing it to system command execution, allowing an attacker to inject and execute arbitrary shell commands when the npmVersion() function is called. An attacker with access to application code that uses this library can execute arbitrary code with the privileges of the running process.
Technical details
The vulnerability exists in the npmVersion() function (line 19 of index.js), which accepts a package name parameter and uses it to construct an npm show command executed via Node.js's child_process.execSync(). The inName parameter is not sanitized or escaped before being concatenated into the shell command, enabling command injection via shell metacharacters. An attacker can inject additional commands using separators such as && or ; to execute arbitrary code. The attack vector requires the attacker to influence the argument passed to npmVersion(), which is feasible in scenarios where user input or external data is passed directly to the function. No patch or workaround has been identified in the provided advisory; affected users should upgrade to a patched version once available or avoid processing untrusted input through this function.
Affected products
- @jswork next-npm-version 1.0.1 and likely all 1.x versions
Timeline
- 2025-10-19: disclosed: Vulnerability reported on GitHub issue #1
- 2026-05-07: advisory: Public disclosure via GHSA-2xx6-qf7x-grqh and CVE-2025-63706