Executive brief
cdxgen is a tool used to create Software Bill of Materials (SBOMs) by scanning project source code. A security flaw in its Maven project scanner allows an attacker to execute malicious commands on the system running the scan. This occurs if cdxgen is used to scan a specially crafted repository containing directory names with malicious characters, potentially leading to unauthorized access or data exposure.
Technical details
A command injection vulnerability exists in the Maven scanning flow of cdxgen. The root cause is the use of `shell: true` during Maven and Bazel command construction, where repository-controlled directory names are passed as arguments without sufficient sanitization. An attacker can exploit this by providing a malicious repository with directory names containing shell metacharacters (e.g., semicolons, backticks, or pipes). When cdxgen scans such a project, the shell interprets these characters, allowing for arbitrary command execution in the context of the cdxgen process. This affects both CLI and server modes (specifically the `POST /sbom` endpoint). The issue is fixed in version 12.4.3 by disabling unconditional shell execution on POSIX and implementing `safeSpawnSync` to block metacharacters.
Affected products
- CycloneDX cdxgen < 12.4.3
Timeline
- 2026-05-22: disclosed: Initial report by @aleff-github
- 2026-06-26: advisory: GitHub Advisory published
- 2026-06-26: patched: Fixed in version 12.4.3