The vulnerability exists in the cyclonedx-node-npm command‑line tool, which creates CycloneDX Software Bill of Materials for npm projects. Between version 2.1.0 and just before version 5.0.0, the CLI forwards a user‑supplied --workspace value directly to a subshell without sanitization when the npm_execpath environment variable is unset or empty. This design flaw permits an attacker who can influence the --workspace argument to inject and execute arbitrary operating‑system commands with the privileges of the user running cyclonedx-node-npm. The flaw results in a classic OS command injection (CWE‑78), potentially exposing confidentiality, integrity, and availability of the host system if an attacker can supply malicious workspace paths.

All installations of CycloneDX:cyclonedx-node-npm with versions ranging from 2.1.0 up to, but not including, 5.0.0 are susceptible. The issue was addressed in the 5.0.0 release, which sanitizes or removes the unsafe argument when npm_execpath is not defined.

The CVSS score of 8.5 indicates a high severity. The EPSS score of <1% suggests that exploitation attempts are currently rare, and the flaw is not listed in the CISA KEV catalog. Nonetheless, the vulnerability can be triggered locally by any user who can provide the --workspace parameter, such as during automated build or continuous‑integration processes that pass untrusted data to cyclonedx-node-npm. Consequently, the risk is significant enough to warrant immediate remediation.