CyberRota Analysis
AI-GeneratedThe @cyclonedx/cyclonedx-npm tool, prior to version 6.0.0, is vulnerable on Windows systems due to a flaw in how it handles the --workspace option, potentially allowing attackers to execute arbitrary shell commands. This vulnerability can lead to unauthorized data access, file modifications, or service disruptions, depending on the privileges of the user running the CLI. Organizations using affected versions should prioritize upgrading to version 6.0.0 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace option. When an attacker can influence that option and the fallback npm execution path is reached, shell metacharacters in the workspace value can execute arbitrary operating-system commands with the privileges of the user running the CLI, allowing data access, file modification, or service disruption. This issue is fixed in version 6.0.0.