Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace option. When an attacker can influence that option and the fallback npm execution path is reached, shell metacharacters in the workspace value can execute arbitrary operating-system commands with the privileges of the user running the CLI, allowing data access, file modification, or service disruption. This issue is fixed in version 6.0.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
🔴 (CycloneDX npm CLI), Command Injection (CWE-78), #CVE-2026-71538 (High) -DC-Sep2026-2415 https://dailycve.com/cyclonedx-npm-cli-command-injection-cwe-78-cve-2026-71538-high-dc-sep2026-2415/
Post summary
The text announces a high-severity Command Injection vulnerability (CVE-2026-71538) in CycloneDX npm CLI with technical details but no mention of PoC, exploits, active exploitation, or patches.
CVE-2026-71538 @cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used w… https://www.cve.org/CVERecord?id=CVE-2026-71538
Post summary
The post discloses CVE-2026-71538 in the @cyclonedx/cyclonedx-npm package, detailing the vulnerable code path in src/npmRunner.ts on Windows, and notes that version 6.0.0 remediates the issue, linking to the official CVE record.