CVE-2026-57998 in better-npm-audit
Summary
by MITRE • 08/22/2026
better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a semicolon, pipe, or command substitution executes arbitrary operating system commands with the privileges of the process running the audit.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified in better-npm-audit versions through 3.11.0 and the 4.0.0-rc.2 prerelease represents a critical server-side code injection flaw rooted in improper neutralization of special elements used in an operating system command, commonly classified under CWE-78 Improper Neutralization of Special Elements used in an OS Command or Insecure Temporary Directory if file paths are involved, though here it is strictly command injection via shell metacharacters. The core technical failure occurs within the src/handlers/handleInput.ts module where the application constructs a string for the npm audit command by directly interpolating user-supplied input from the --registry option without any form of validation, sanitization, or quoting mechanisms. This design choice assumes that registry URLs are benign strings but fails to account for the fact that they can contain characters with special meaning in shell environments.
The severity of this flaw is amplified by how the constructed command string is executed. In index.ts, the application utilizes child_process.exec() to spawn a new process and run the npm audit command. Unlike methods such as execFile or fork which execute binaries directly without invoking an intermediate shell, exec passes the entire command string through /bin/sh -c on Unix-like systems or cmd.exe on Windows. This means that any special characters present in the registry URL are interpreted by the shell itself rather than being treated as literal data passed to npm. Consequently, if a user provides a registry value containing shell metacharacters such as semicolons, pipes, backticks for command substitution, or ampersands, these characters allow an attacker to break out of the intended npm audit context and inject arbitrary operating system commands into the execution pipeline.
From an operational impact perspective, this vulnerability allows for remote code execution with the privileges of the process running the audit tool. If a developer runs better-npm-audit in their local development environment or within a CI/CD pipeline using untrusted registry configurations, they risk executing malicious scripts that could exfiltrate sensitive data, install backdoors, or compromise the build infrastructure. The attack vector is particularly dangerous because it can be triggered simply by configuring the tool to point at a maliciously crafted npm mirror or URL provided via command line arguments or configuration files that are processed automatically. This aligns with ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving shell commands like sh or cmd.exe, as well as potential data exfiltration techniques if the injected commands send stolen credentials to an external server.
Mitigation strategies for this vulnerability require immediate updates to affected versions where patches have been applied by the maintainers to properly sanitize and quote user inputs before passing them to system command executors. In environments where upgrading is not immediately feasible, administrators should enforce strict input validation on registry URLs, ensuring they only contain alphanumeric characters, hyphens, underscores, periods, colons, forward slashes, and equals signs typical of valid npm registries while rejecting any shell metacharacters such as ; | & $ ` \ " ' < >. Additionally, replacing the use of child_process.exec with safer alternatives like child_process.spawn or execFile is recommended for future development to eliminate the shell interpretation layer entirely. Security teams should also audit their CI/CD pipelines and local configurations to ensure that no untrusted registry URLs are being passed dynamically into auditing tools without rigorous validation checks in place.