CVE-2026-71538 | CycloneDX cyclonedx-node-npm up to 5.x Windows Fallback Path src/npmRunner.ts workspace os command injection

September 17, 2026 Yanac

A vulnerability has been found in CycloneDX cyclonedx-node-npm up to 5.x and classified as problematic. Affected is an unknown function of the file src/npmRunner.ts of the component Windows Fallback Path. The manipulation of the argument workspace leads to os command injection.

This vulnerability is listed as CVE-2026-71538. The attack must be carried out locally. There is no available exploit.

The affected component should be upgraded.VulDB Recent EntriesRead More