CVE-2026-57998 PUBLISHED

better-npm-audit OS Command Injection via registry flag

Assigner: VulnCheck
Reserved: 26.06.2026 Published: 22.08.2026 Updated: 22.08.2026

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a semicolon, pipe, or command substitution executes arbitrary operating system commands with the privileges of the process running the audit.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.5

Product Status

Vendor jeemok
Product better-npm-audit
Versions Default: unaffected
  • affected from 0 to 3.11.0 (incl.)
  • Version 4.0.0-rc.2 is affected

Credits

  • MD Mahmidul Hasan (BL4CK 570RM) finder

References

Problem Types

  • Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE