@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

Summary

A Windows-specific command injection vulnerability exists in @cyclonedx/cyclonedx-npm when the CLI is invoked with the --workspace <value> option.
User-supplied --workspace values can be passed to a shell command without proper neutralization on the Windows fallback execution path, enabling attackers to inject arbitrary OS commands.

The vulnerability was fixed in version [6.0.0][v6.0.0].

Vulnerability Details

When cyclonedx-npm is executed with the --workspace option, the provided argument is incorporated into an internal command execution flow.
On Windows systems, this path can interpret untrusted --workspace input as shell syntax if not safely handled.

As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user.

Impact

An attacker who can influence the value passed to --workspace can execute arbitrary OS commands on Windows hosts.
This may lead to:

• Arbitrary command execution
• Data exfiltration
• Local privilege escalation (depending on runtime context and privileges)
• Modification or destruction of files accessible to the user running the CLI

The vulnerability affects only scenarios where:

• The user invokes cyclonedx-npm with --workspace <value>, and
• The vulnerable execution path is reached on Windows.

Exploitation Conditions (High-Level)

Exploitation requires the attacker to supply or influence the --workspace value passed to the CLI.
If the tool falls back to the vulnerable shell execution path on Windows, specially crafted workspace identifiers can cause unintended command execution.
No exploit code is included here to avoid providing weaponizable examples.

Root Cause

The CLI fallback execution path on Windows constructed a shell command using untrusted input from the --workspace option.
Because the fallback code path does not sanitize or escape the workspace value, special shell metacharacters (e.g., >, &, |) are interpreted by the shell, enabling command injection.

Fix

The vulnerability was resolved in [PR #1489], which ensures workspace values are handled safely and are no longer passed to a vulnerable shell execution path.

The fix is included in @cyclonedx/cyclonedx-npm version [6.0.0][v6.0.0].

Remediation

• Upgrade to version [6.0.0][v6.0.0] or later, which contains the complete fix.
• As a temporary mitigation for older versions, ensure that the environment variable npm_execpath is set to a npm-cli.js before invoking the tool.
• Avoid passing untrusted or user-controlled values to the --workspace option.
• If immediate upgrade is not possible, prioritize mitigation on Windows systems, where exploitability exists.