Is CVE-2026-55849 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55849 being exploited in the wild.

How severe is CVE-2026-55849?

High severity, with a CVSS score of 4, published 8 July 2026.

Which products and versions are affected?

Cyclonedx-Npm >= 2.1.0, = 2.1.0, < 5.0.0, SEMVER:introduced=2.1.0,fixed=5.0.0.

Is there a fix for CVE-2026-55849?

Yes. @cyclonedx/cyclonedx-npm (npm): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55849 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-55849?

Check whether you run Cyclonedx-Npm or @cyclonedx/cyclonedx-npm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55849: CycloneDX cyclonedx-npm OS command injection in --workspace argument

Q: Is there a fix for CVE-2026-55849?

Yes. @cyclonedx/cyclonedx-npm (npm): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55849 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-55849?

Check whether you run Cyclonedx-Npm or @cyclonedx/cyclonedx-npm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55849 · Severity: high · CVSS 4 · Published 2026-07-08

A security vulnerability exists in the CycloneDX tool used to generate Software Bill of Materials (SBOM) for npm projects. If an attacker can influence the workspace name used during the generation process, they can execute unauthorized commands on the system. This could lead to the theft of sensitive data, modification of files, or full system compromise depending on the permissions of the user running the tool.

Vendors: CycloneDX, npm.

Quick answers

Is CVE-2026-55849 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55849 being exploited in the wild.
How severe is CVE-2026-55849?: High severity, with a CVSS score of 4, published 8 July 2026.
Which products and versions are affected?: Cyclonedx-Npm >= 2.1.0, < 5.0.0; @cyclonedx/cyclonedx-npm (npm) >= 2.1.0, < 5.0.0, SEMVER:introduced=2.1.0,fixed=5.0.0.
Is there a fix for CVE-2026-55849?: Yes. @cyclonedx/cyclonedx-npm (npm): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55849 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-55849?: Check whether you run Cyclonedx-Npm or @cyclonedx/cyclonedx-npm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@cyclonedx/cyclonedx-npm (npm): upgrade to 5.0.0 or later
```
npm install @cyclonedx/cyclonedx-npm@5.0.0
```

Technical details

A command injection vulnerability (CWE-78) exists in @cyclonedx/cyclonedx-npm versions 2.1.0 through 4.2.1. The vulnerability occurs when the CLI is invoked with the --workspace option while the npm_execpath environment variable is unset or empty. In this specific state, the tool falls back to a code path that interpolates the user-supplied workspace value directly into a shell command string without proper sanitization or escaping. An attacker providing a crafted workspace name containing shell metacharacters (e.g., semicolons or pipes) can achieve arbitrary code execution with the privileges of the user running the CLI. The issue is resolved in version 5.0.0 by reworking npm handling to avoid unsafe subshell execution.

Affected products

CycloneDX cyclonedx-npm >= 2.1.0, < 5.0.0

Identifiers

CVE-2026-55849
GHSA-v75r-vx73-82pj

Timeline

2026-06-11: other: Initial fix and regression tests developed
2026-06-16: patched: Version 5.0.0 released and PR merged
2026-07-08: disclosed: CVE-2026-55849 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.