CVE-2026-71538: @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
A Windows-specific command injection vulnerability exists in @cyclonedx/cyclonedx-npm when the CLI is invoked with the --workspace <value> option.
User-supplied --workspace values can be passed to a shell command without proper neutralization on the Windows fallback execution path, enabling attackers to inject arbitrary OS commands.
The vulnerability was fixed in version [6.0.0][v6.0.0].
References
- github.com/CycloneDX/cyclonedx-node-npm/commit/15d3beb5bcd2b0b6eccfdf31192f5103b3f12c0f
- github.com/CycloneDX/cyclonedx-node-npm/pull/1489
- github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v6.0.0
- github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-q69g-4hcv-6jg4
- github.com/advisories/GHSA-q69g-4hcv-6jg4
- nvd.nist.gov/vuln/detail/CVE-2026-71538
Code Behaviors & Features
Detect and mitigate CVE-2026-71538 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →