The vulnerability is a classic command injection flaw that allows an attacker to execute arbitrary system commands. Consequently, an adversary could gain unauthorized access to the host, modify or delete files, and potentially disrupt services, thereby compromising confidentiality, integrity, and availability.

The affected component is the npm package next-npm-version version 1.0.1, which is distributed via npm. It is typically used in Node.js environments and may be incorporated into build or deployment scripts.

No published CVSS or EPSS score is available, but command injection is generally considered a high‑severity weakness. The likely attack vector is indirect—through a user’s input that is passed unchecked to a shell command invoked by the package. If the package processes data from untrusted sources, an attacker could exploit the flaw to run arbitrary code.