Command Injection Vulnerability in CycloneDX Software Bill of Materials by CycloneDX

CVE-2026-71538

What is CVE-2026-71538?

The CycloneDX Software Bill of Materials tool, designed to create a CycloneDX document from npm projects, is susceptible to a command injection vulnerability present in versions prior to 6.0.0. When the npm_execpath does not provide the npm CLI path, a fallback method can lead to potentially dangerous shell commands being constructed with untrusted input from the --workspace option. If an attacker can manipulate this option, they can exploit shell metacharacters to execute arbitrary commands on the operating system with the current user's privileges, posing a serious risk of unauthorized data access, file modification, or disruption of services. This issue has been addressed in version 6.0.0.

References