CVE-2026-55849: CycloneDX npm RCE Vulnerability

CVE-2026-55849 Overview

CVE-2026-55849 is a command injection vulnerability [CWE-78] in @cyclonedx/cyclonedx-npm, a CLI tool that generates CycloneDX Software Bill of Materials (SBOM) from npm projects. Versions from 2.1.0 up to (but not including) 5.0.0 pass user-supplied --workspace values to a subshell without proper sanitization when the npm_execpath environment variable is unset or empty. An attacker who can control the --workspace argument can execute arbitrary operating system commands with the privileges of the invoking user. The issue is fixed in version 5.0.0.

Critical Impact
Arbitrary OS command execution occurs when a crafted --workspace argument is processed by the CLI in environments where npm_execpath is unset.

Affected Products

@cyclonedx/cyclonedx-npm versions >=2.1.0 and <5.0.0
CI/CD pipelines invoking the CLI directly (without npm setting npm_execpath)
Developer workstations running the CLI outside of an npm script context

Discovery Timeline

2026-07-08 - CVE-2026-55849 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55849

Vulnerability Analysis

The CLI accepts a --workspace option that identifies an npm workspace to include in the generated SBOM. Internally, the tool needs to invoke npm to enumerate workspace metadata. When npm_execpath is set by the parent npm process, the tool uses that binary path directly. When the variable is unset or empty, the tool falls back to invoking npm through a subshell, and the --workspace value is interpolated into the shell command without escaping.

An attacker who supplies a value containing shell metacharacters, such as backticks, $(...), or ;, achieves command execution in the context of the invoking user. Because SBOM generation is frequently automated in CI/CD pipelines, the workspace argument is often derived from repository configuration, pull request metadata, or matrix parameters that an untrusted contributor can influence.

Root Cause

The root cause is unsanitized command construction in the npm runner logic. The CLI concatenates the --workspace value into a shell command string and executes it through a subshell rather than passing arguments as an array to a direct process spawn. This design assumes callers control the argument, which does not hold when the tool runs against arbitrary repositories.

Attack Vector

Exploitation requires local execution of the CLI with attacker-influenced input and some user interaction, such as running an SBOM generation step in CI against a malicious branch. The fix hardens the runner by introducing platform-specific matchers to distinguish executable types on Windows and to route invocation appropriately without shell interpretation.

typescript

    */
   static readonly #npxMatcher = /(^|\\|\/)npx-cli\.js$/
 
+  static readonly #winExeMatcher = /\.(exe|com)$/i
+  static readonly #winCmdMatcher = /\.(cmd|bat)$/i
+
   constructor (process_: NodeJS.Process, console_: Console) {
     this.run = NpmRunner.#makeNpmRunner(process_, console_)
   }

Source: GitHub Commit 9f64625 — the patch adds executable-type detection in src/npmRunner.ts so the runner can bypass shell interpretation when invoking npm on Windows and avoid unsafe interpolation of workspace arguments.

Detection Methods for CVE-2026-55849

Indicators of Compromise

Unexpected child processes spawned by node or npm shortly after cyclonedx-npm invocation, particularly shells (sh, bash, cmd.exe, powershell.exe).
Outbound network connections originating from CI runner processes during SBOM generation steps.
Command lines containing --workspace values with shell metacharacters such as backticks, $(, ;, &&, or |.

Detection Strategies

Inspect CI/CD job logs for cyclonedx-npm invocations where the --workspace argument is sourced from repository-controlled variables or pull request metadata.
Alert on process ancestry showing cyclonedx-npm as a parent of unexpected interpreters or downloaders such as curl, wget, or powershell -enc.
Correlate npm SBOM generation steps against changes in package.jsonworkspaces fields introduced by untrusted contributors.

Monitoring Recommendations

Enable command-line auditing on build agents and forward events to a central log store for review.
Track outbound DNS and HTTP requests from CI runners against an allowlist of expected registries and mirrors.
Review installed versions of @cyclonedx/cyclonedx-npm across build images and developer workstations to identify vulnerable ranges.

How to Mitigate CVE-2026-55849

Immediate Actions Required

Upgrade @cyclonedx/cyclonedx-npm to version 5.0.0 or later in all projects, CI pipelines, and container images.
Audit CI workflows that generate SBOMs to confirm the --workspace argument is not derived from untrusted repository content or pull request inputs.
Rotate credentials that were accessible to build agents if the tool was executed against untrusted branches while running a vulnerable version.

Patch Information

The fix is included in the v5.0.0 release via Pull Request #1476 and commit 9f64625. Details are documented in GHSA-v75r-vx73-82pj.

Workarounds

Invoke the CLI through npm exec or npx so that npm sets npm_execpath, which avoids the vulnerable subshell code path.
Restrict SBOM generation to trusted branches and require code review before workflows run against contributor forks.
Sanitize or hardcode the --workspace argument in pipeline definitions rather than passing dynamic values.

bash

# Upgrade to the patched version
npm install --save-dev @cyclonedx/cyclonedx-npm@^5.0.0

# Preferred invocation ensures npm_execpath is set
npm exec -- cyclonedx-npm --output-file bom.json