The vulnerability is a classic command injection flaw in the npm package next-npm-version 1.0.1 that allows an attacker to execute arbitrary system commands. Consequently, an adversary could gain unauthorized access to the host, modify or delete files, and potentially disrupt services, thereby compromising confidentiality, integrity, and availability. The CVSS score of 9.8 indicates a high severity impact.

The affected component is the npm package next-npm-version version 1.0.1, which is distributed via npm. It is typically used in Node.js environments and may be incorporated into build or deployment scripts.

The CVSS score of 9.8 reflects a severe vulnerability, and the EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is indirect—through unsanitized user input that is passed to a shell command within the package. If the package processes data from untrusted sources, an attacker could exploit this flaw to run arbitrary system commands. The flaw maps to CWE-94 (Improper Control of Generation of Code).