The @cyclonedx/cyclonedx-node-npm tool creates Software Bill of Materials for npm projects. Between versions 2.1.0 and before 5.0.0, the command‑line interface passes a user‑supplied --workspace argument directly to a subshell without sanitization when the npm_execpath environment variable is unset or empty. This flaw allows an attacker who can influence the --workspace value to execute arbitrary operating‑system commands with the same privileges as the user running the tool. The vulnerability is a classic OS command injection, capable of compromising confidentiality, integrity, and availability of the host system.

All installations of CycloneDX:cyclonedx-node-npm from version 2.1.0 up to, but not including, 5.0.0 are affected. The issue is resolved in version 5.0.0, which either sanitizes or removes the unsafe argument when npm_execpath is not defined.

With a CVSS score of 8.5, the vulnerability is high severity. The EPSS score of <1% indicates that exploitation attempts are currently rare, and the flaw is not listed in CISA's KEV catalog. However, the flaw can be triggered locally by any user who can provide the --workspace option, such as automated build or CI processes handling untrusted data. The risk remains significant enough to warrant immediate remediation.