Description

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a semicolon, pipe, or command substitution executes arbitrary operating system commands with the privileges of the process running the audit.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-22T13:16:38.263Z",
  "pubdate": "2026-08-22T13:16:38.263Z",
  "executiveSummary": "A remote command injection vulnerability exists in better-npm-audit through 3.11.0 and the 4.0.0-rc.2 prerelease. The vulnerability arises from insecure handling of user-supplied input within the --registry option, which is interpolated directly into a constructed command string without prior validation or proper shell quoting. This command string is subsequently passed to the child_process.exec() function in index.ts, resulting in the spawning of a system shell.\nThe impact of this flaw is severe, allowing an attacker to achieve arbitrary operating system command execution with the full privileges of the user running the audit process. Attack capabilities include complete system compromise, data exfiltration, and lateral movement depending on the execution context. Exploitation requires the attacker to supply a malicious registry value containing shell metacharacters such as semicolons, pipes, or command substitution sequences, typically via command-line arguments or configuration files processed by the utility.",
  "technicalDetails": "The root cause of the vulnerability is unsafe command construction and execution within the application logic. Specifically, in src/handlers/handleInput.ts, the utility takes the user-supplied --registry option and concatenates it directly into the npm audit command string without sanitization, validation, or argument quoting.\nThe attack flow proceeds as follows: an attacker provides a maliciously crafted string via the --registry option containing shell metacharacters (e.g., semicolons, pipes, or backticks for command substitution). The application processes this input in src/handlers/handleInput.ts and generates the vulnerable command string. This string is then passed directly to the child_process.exec() function located in index.ts.\nBecause child_process.exec() spawns a secondary shell (such as /bin/sh on UNIX-like systems) to evaluate the command string, the operating system interprets the embedded shell metacharacters within the registry parameter. Consequently, the injected operating system commands are executed with the privileges of the process running the audit.\nThe vulnerable component spans src/handlers/handleInput.ts and index.ts. Affected versions comprise better-npm-audit through 3.11.0 and the 4.0.0-rc.2 prerelease. Authentication and network exposure depend on the context in which the utility is invoked, but the vulnerability can be triggered locally via malicious configuration files or command-line parameters, as well as potentially via untrusted CI/CD pipeline inputs where external parameters influence the registry setting."
}