Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 26 June 2026.

Which products and versions are affected?

CycloneDX Cdxgen before 12.4.3; @cyclonedx/cdxgen (npm) SEMVER:introduced=0,fixed=12.4.3.

Is there a fix for This vulnerability?

Yes. @cyclonedx/cdxgen (npm): upgrade to 12.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network or with local access, in a software library.

Check whether you run CycloneDX Cdxgen or @cyclonedx/cdxgen (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CycloneDX cdxgen command injection in Maven scanning

Severity: medium · CVSS 4 · Published 2026-06-26

cdxgen is a tool that generates software bill-of-materials (SBOM) documents by analyzing source code and dependencies, commonly integrated into CI/CD pipelines. The Maven scanning feature contains a command injection flaw that allows an attacker controlling a repository to execute arbitrary shell commands when cdxgen processes the project, potentially compromising build infrastructure and accessing sensitive data.

Technologies: CycloneDX Cdxgen, @cyclonedx/cdxgen (npm). Vendors: CycloneDX, npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 26 June 2026.
Which products and versions are affected?: CycloneDX Cdxgen before 12.4.3; @cyclonedx/cdxgen (npm) SEMVER:introduced=0,fixed=12.4.3.
Is there a fix for This vulnerability?: Yes. @cyclonedx/cdxgen (npm): upgrade to 12.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network or with local access, in a software library.
Am I affected?: Check whether you run CycloneDX Cdxgen or @cyclonedx/cdxgen (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@cyclonedx/cdxgen (npm): upgrade to 12.4.3 or later
```
npm install @cyclonedx/cdxgen@12.4.3
```

Technical details

This is a command injection vulnerability (CWE-78, CWE-88) in the Maven project scanning component of cdxgen. The root cause is that Maven invocations were executed with shell: true on POSIX platforms, and attacker-controlled module paths from the repository were passed directly into shell command construction without proper escaping or validation. An attacker can exploit this by crafting a Maven project directory structure containing shell metacharacters (e.g., semicolons, pipes, backticks) that get interpreted by the shell when Maven is invoked. This affects both the CLI scanning mode and the server mode (POST /sbom endpoint), requiring only network access to the server (or local filesystem access for CLI) with no authentication or user interaction required. The fix in version 12.4.3 removes unconditional shell execution for Maven commands on POSIX systems and adds safeSpawnSync checks to block shell: true when command/argument values contain metacharacters.

Affected products

CycloneDX @cyclonedx/cdxgen before 12.4.3

Timeline

2026-05-22: disclosed
2026-05-22: patched: Version 12.4.3 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.