GHSA-q69g-4hcv-6jg4 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

• npm @cyclonedx/cyclonedx-npm: < 6.0.0 → fixed in 6.0.0

Summary A Windows-specific command injection vulnerability exists in `@cyclonedx/cyclonedx-npm` when the CLI is invoked with the `--workspace ` option. User-supplied `--workspace` values can be passed to a shell command without proper neutralization on the Windows fallback execution path, enabling attackers to inject arbitrary OS commands. The vulnerability was fixed in version [6.0.0][v6.0.0]. Vulnerability Details When `cyclonedx-npm` is executed with the `--workspace` option, the provided argument is incorporated into an internal command execution flow. On Windows systems, this path can interpret untrusted `--workspace` input as shell syntax if not safely handled. As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user. Impact An attacker who can influence the value passed to `--workspace` can execute arbitrary OS commands on Windows hosts. This may lead to: • Arbitrary command execution • Data exfiltration • Local privilege escalation (depending on runtime context and privileges) • Modification or destruction of files accessible to the user running the CLI The vulnerability affects only scenarios where: • The user invokes `cyclonedx-npm` with `--workspace `, and • The vulnerable execution path is reached on Windows. Exploitation Conditions (High-Level) Exploitation requires the attacker to supply or influence the `--workspace` value passed to the CLI. If the tool falls back to the vulnerable shell execution path on Windows, specially crafted workspace identifiers can cause unintended command execution. No exploit code is included here to avoid providing weaponizable examples. Root Cause The CLI fallback execution path on Windows constructed a shell command using untrusted input from the `--workspace` option. Because the fallback code path does not sanitize or escape the workspace value, special shell metacharacters (e.g., `>`, `&`, `|`) are interpreted by the shell, enabling command injection. Fix The vulnerability was resolved in [PR #1489], which ensures workspace values are handled safely and are no longer passed to a vulnerable shell execution path. The fix is included in `@cyclonedx/cyclonedx-npm` version [6.0.0][v6.0.0]. Remediation • Upgrade to version [6.0.0][v6.0.0] or later, which contains the complete fix. • As a temporary mitigation for older versions, ensure that the environment variable `npm_execpath` is set to a `npm-cli.js` before invoking the tool. • Avoid passing untrusted or user-controlled values to the `--workspace` option. • If immediate upgrade is not possible, prioritize mitigation on Windows systems, where exploitability exists.