CVE-2026-57998
better-npm-audit OS Command Injection via registry flag
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a semicolon, pipe, or command substitution executes arbitrary operating system commands with the privileges of the process running the audit.
| CWE | CWE-78 |
| Vendor | jeemok |
| Product | better-npm-audit |
| Published | Aug 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for jeemok better-npm-audit
Be the first to know when new high vulnerabilities affecting jeemok better-npm-audit are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
jeemok / better-npm-audit
0 ≤ 3.11.0 4.0.0-rc.2
References
github.com: https://github.com/jeemok/better-npm-audit/issues/119 github.com: https://github.com/jeemok/better-npm-audit github.com: https://github.com/jeemok/better-npm-audit/blob/fd99a0f41ff4342b8a0a6fdbe5a17261de3d0544/src/handlers/handleInput.ts#L30-L37 github.com: https://github.com/jeemok/better-npm-audit/blob/fd99a0f41ff4342b8a0a6fdbe5a17261de3d0544/index.ts#L34 github.com: https://github.com/jeemok/better-npm-audit/pull/120 vulncheck.com: https://www.vulncheck.com/advisories/better-npm-audit-os-command-injection-via-registry-flag
Credits
MD Mahmidul Hasan (BL4CK 570RM)