Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.
CVE-2026-55849 is a low severity vulnerability with a CVSS score of 0.0. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
A command injection vulnerability exists in @cyclonedx/cyclonedx-npm when the CLI is invoked with the --workspace <value> option while the environment variable npm_execpath is unset or empty.
User‑supplied --workspace values are passed to a subshell without proper sanitization, enabling attackers to inject arbitrary OS commands.
This issue corresponds to CWE‑78: Improper Neutralization of Special Elements used in an OS Command.
The vulnerability was fixed in version 5.0.0.
When cyclonedx-npm is executed with the --workspace option, the provided argument is incorporated into an internal shell command.
If the environment variable npm_execpath is set, the tool uses the npm executable directly and no injection occurs.
However, when npm_execpath is unset or empty, the tool falls back to spawning a subshell and interpolating the --workspace value directly into the command string without proper escaping or neutralization.
As a result, specially crafted workspace names can break out of the intended command context and execute arbitrary commands with the privileges of the invoking user.
An attacker who can influence the value passed to --workspace can execute arbitrary OS commands.
This may lead to:
The vulnerability affects only scenarios where:
cyclonedx-npm with --workspace <value>, andnpm_execpath is unset or emptyExploitation requires the attacker to supply or influence the value passed to the CLI. If the tool falls back to its subshell execution path, specially crafted workspace identifiers can cause unintended command execution. No exploit code is included here to avoid providing weaponizable examples.
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.
--workspaceThe CLI constructs a shell command using untrusted input from the --workspace option.
Because the fallback code path does not sanitize or escape the workspace value, special shell metacharacters (e.g., ;, &&, |) are interpreted by the shell, enabling command injection.
This behavior matches CWE‑78.
The vulnerability was resolved in PR #1476, which ensures that workspace values are handled safely and are no longer passed to a subshell in an unsafe manner.
The fix is included in @cyclonedx/cyclonedx-npm version 5.0.0.
npm_execpath is set before invoking the tool.--workspace option.