CVE-2026-57998
Received Received - Intake

better-npm-audit Registry Command Injection via Unsanitized Input

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: VulnCheck

Description
better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a semicolon, pipe, or command substitution executes arbitrary operating system commands with the privileges of the process running the audit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-57998
EUVD
EUVD-2026-64261

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jeemok better-npm-audit 3.11.0
jeemok better-npm-audit 4.0.0-rc.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an OS Command Injection vulnerability in the better-npm-audit package. The tool improperly handles the --registry flag by directly inserting user input into a command string without validation or escaping. Attackers can inject shell metacharacters like semicolons or pipes to execute arbitrary operating system commands with the privileges of the running process.

Detection Guidance

Check if better-npm-audit versions 3.11.0 or earlier are installed using 'npm list better-npm-audit'. Look for suspicious command execution logs in CI/CD pipelines or npm audit logs. Monitor network traffic for unexpected outbound connections from npm processes.

Impact Analysis

An attacker could execute arbitrary commands on your system, potentially leading to full system compromise, data theft, or privilege escalation. This could affect development environments, CI/CD pipelines, or any automated workflows using vulnerable versions of better-npm-audit.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade better-npm-audit to the latest patched version immediately. Avoid using the --registry flag with untrusted input. If possible, replace exec() with execFile() in the tool's codebase. Review .nsprc files for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57998. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart