CVE-2026-55849

npm/@cyclonedx/cyclonedx-npm CVE-2026-55849: high, EPSS 0.24%

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument

Action: Upgrade @cyclonedx/cyclonedx-npm to 5.0.0 or later.

npm i @cyclonedx/cyclonedx-npm@5.0.0

Affected

Fixed versions

Sources

• osv: GHSA-v75r-vx73-82pj
• https://github.com/CycloneDX/cyclonedx-node-npm/security/advisories/GHSA-v75r-vx73-82pj
• https://github.com/CycloneDX/cyclonedx-node-npm/pull/1476
• https://github.com/CycloneDX/cyclonedx-node-npm
• https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v5.0.0

CVE-2026-55849 · published 2026-06-19T20:47:48Z · modified 2026-09-10T03:50:50.587596585Z · JSON