jeemok better-npm-audit up to 3.11.0/4.0.0-rc.2 Input handleInput.ts child_process.exec registry os command injection

Summaryinfo

A vulnerability was found in jeemok better-npm-audit up to 3.11.0/4.0.0-rc.2. It has been rated as problematic. Affected by this vulnerability is the function child_process.exec of the file src/handlers/handleInput.ts of the component Input Handler. Performing a manipulation of the argument registry results in os command injection. This vulnerability is reported as CVE-2026-57998. The attack requires a local approach. No exploit exists.

Detailsinfo

A vulnerability classified as problematic has been found in jeemok better-npm-audit up to 3.11.0/4.0.0-rc.2. This affects the function child_process.exec of the file src/handlers/handleInput.ts of the component Input Handler. The manipulation of the argument registry with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a semicolon, pipe, or command substitution executes arbitrary operating system commands with the privileges of the process running the audit.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-57998 since 06/26/2026. The exploitability is told to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Software Library

Vendor

• jeemok

Name

• better-npm-audit

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11.0
• 4.0.0-rc.0
• 4.0.0-rc.1
• 4.0.0-rc.2

Website

• Product: https://github.com/jeemok/better-npm-audit/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion