cyclonedx-node-npm vulnerabilities

2 known vulnerabilities in cyclonedx-node-npm from CycloneDX. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.5 High severity

  cyclonedx-node-npm: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-71538Sep 17, 2026CycloneDX

  @cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, can construct a shell command containing a

• 8.5 High severity

  cyclonedx-node-npm: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-55849Jul 8, 2026CycloneDX

  @cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary