CVE-2026-57998: better-npm-audit Command Injection RCE

CVE-2026-57998 Overview

CVE-2026-57998 is an operating system command injection vulnerability in better-npm-audit, a popular npm package used to run enhanced audits against Node.js dependencies. The flaw exists in versions through 3.11.0 and in the 4.0.0-rc.2 prerelease. The tool builds its npm audit command by interpolating the user-supplied --registry option into a shell command string without validation or quoting. Passing the resulting string to child_process.exec() invokes a shell, allowing shell metacharacters in the registry value to execute arbitrary commands. The issue is tracked under CWE-78 and referenced in the VulnCheck Advisory on Command Injection.

Critical Impact
An attacker who controls the --registry value passed to better-npm-audit executes arbitrary OS commands with the privileges of the auditing process, commonly a developer workstation or continuous integration runner.

Affected Products

better-npm-audit versions up to and including 3.11.0
better-npm-audit prerelease 4.0.0-rc.2
Node.js build pipelines and CI jobs invoking better-npm-audit with untrusted --registry input

Discovery Timeline

2026-08-22 - CVE-2026-57998 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-57998

Vulnerability Analysis

The defect is a classic OS command injection in a Node.js command-line tool. According to the advisory, src/handlers/handleInput.ts constructs the audit command by string interpolation of the --registry option. The resulting string is then passed to child_process.exec() in index.ts, which spawns a shell to interpret the command. Because the shell parses metacharacters such as ;, |, &&, backticks, and $(), any registry value containing those characters causes the shell to execute attacker-supplied commands alongside the intended npm audit invocation.

Exploitation runs with the same privileges as the user or service account running the audit. In CI/CD environments this frequently includes access to source repositories, build artifacts, signing keys, and cloud credentials exposed as environment variables. See the upstream GitHub Issue #119 and GitHub Pull Request #120 for the maintainer discussion.

Root Cause

The root cause is unsanitized interpolation of user-controlled input into a shell command string. The referenced code path at handleInput.ts lines 30-37 concatenates the --registry value, and index.ts line 34 hands the string to child_process.exec() rather than execFile() or spawn() with an argument array.

Attack Vector

Exploitation requires an attacker to influence the --registry argument. This can occur when a script, package.json entry, CI configuration file, or wrapper tool forwards an externally sourced value into better-npm-audit. A crafted registry string such as https://example.com; <command> triggers execution of the appended command by the invoking shell. The CVSS 4.0 vector indicates local attack vector with passive user interaction, consistent with a developer running an audit against a repository that supplies the malicious flag.

No verified public exploit code has been referenced in the advisory. The vulnerability mechanism is described in prose above; further technical detail is available in the VulnCheck advisory.

Detection Methods for CVE-2026-57998

Indicators of Compromise

Child processes of node or better-npm-audit that spawn shells (sh, bash, cmd.exe, powershell.exe) with command lines containing shell metacharacters after --registry.
Unexpected outbound network connections from CI runners or developer workstations during dependency audit stages.
New or modified files under home directories, .npmrc, or CI workspace paths coinciding with npm audit invocations.

Detection Strategies

Inspect version manifests and lockfiles for better-npm-audit at or below 3.11.0 or equal to 4.0.0-rc.2.
Audit shell histories, CI logs, and build scripts for better-npm-audit --registry invocations where the registry value is templated from environment variables, pipeline parameters, or repository files.
Correlate process trees showing node invoking /bin/sh -c with command strings containing ;, |, &&, `, or $(.

Monitoring Recommendations

Alert on any Node.js process spawning a shell interpreter during dependency audit workflows.
Baseline the expected command lines produced by better-npm-audit in CI and flag deviations.
Route developer endpoint and CI runner telemetry to a centralized data lake for retrospective hunting against this pattern.

How to Mitigate CVE-2026-57998

Immediate Actions Required

Pin better-npm-audit to a fixed release once published by the maintainer and remove 4.0.0-rc.2 from any pipeline.
Remove or hardcode the --registry flag in scripts and CI configuration so it cannot be influenced by external input.
Rotate secrets exposed to CI jobs that ran better-npm-audit with attacker-controllable registry values.

Patch Information

The maintainer discussion and fix are tracked in GitHub Pull Request #120 and GitHub Issue #119 in the better-npm-audit repository. Consumers should upgrade to a release that replaces child_process.exec() with execFile() or spawn() using an argument array, or that validates the registry value against a strict URL allowlist. Until an updated release is available, treat the package as unsafe when the --registry argument is not fully controlled by the operator.

Workarounds

Replace better-npm-audit with the built-in npm audit command where the enhanced reporting is not required.
Wrap invocations to force a known-good registry URL and reject any override from environment variables, arguments, or repository files.
Run dependency audits inside an ephemeral, network-restricted sandbox with no access to production credentials.

bash

# Configuration example: force a fixed registry and reject overrides
npx --no-install better-npm-audit audit --registry "https://registry.npmjs.org/"