Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a semicolon, pipe, or command substitution executes arbitrary operating system commands with the privileges of the process running the audit.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-57998 Arbitrary Command Execution in better-npm-audit via Registry Option https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-57998
Post summary
The post announces CVE‑2026‑57998 as an arbitrary command execution flaw in better‑npm‑audit triggered by a registry option, with no claim of active exploitation, patches, or PoC details.