Executive brief
A security vulnerability exists in the CycloneDX tool used to generate Software Bill of Materials (SBOM) for npm projects. If an attacker can influence the workspace name used during the generation process, they can execute unauthorized commands on the system. This could lead to the theft of sensitive data, modification of files, or full system compromise depending on the permissions of the user running the tool.
Technical details
A command injection vulnerability (CWE-78) exists in @cyclonedx/cyclonedx-npm versions 2.1.0 through 4.2.1. The vulnerability occurs when the CLI is invoked with the --workspace option while the npm_execpath environment variable is unset or empty. In this specific state, the tool falls back to a code path that interpolates the user-supplied workspace value directly into a shell command string without proper sanitization or escaping. An attacker providing a crafted workspace name containing shell metacharacters (e.g., semicolons or pipes) can achieve arbitrary code execution with the privileges of the user running the CLI. The issue is resolved in version 5.0.0 by reworking npm handling to avoid unsafe subshell execution.
Affected products
- CycloneDX cyclonedx-npm >= 2.1.0, < 5.0.0
Timeline
- 2026-06-11: other: Initial fix and regression tests developed
- 2026-06-16: patched: Version 5.0.0 released and PR merged
- 2026-07-08: disclosed: CVE-2026-55849 published
References
- https://github.com/CycloneDX/cyclonedx-node-npm/commit/9f646253f4263d8644dadb86e5597fad996f688f
- https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476
- https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0
- https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj