Количество 2
Количество 2
CVE-2026-55849
@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0.
GHSA-v75r-vx73-82pj
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-55849 @cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of the invoking user. This issue is fixed in version 5.0.0. | 0% Низкий | 2 месяца назад | |
| GHSA-v75r-vx73-82pj @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument | 0% Низкий | 3 месяца назад |
Уязвимостей на страницу