CyberRota Analysis
AI-GeneratedThe vulnerability exists in better-npm-audit versions up to 3.11.0 and the 4.0.0-rc.2 prerelease, where user-supplied input for the --registry option is improperly handled, allowing for command injection through shell metacharacters. This flaw can lead to arbitrary operating system command execution with the privileges of the process, posing a significant risk to systems utilizing this tool. Organizations using better-npm-audit should prioritize patching or upgrading to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a semicolon, pipe, or command substitution executes arbitrary operating system commands with the privileges of the process running the audit.