![CVE-2026-57998: better-npm-audit OS Command Injection via registry flag [HIGH] CVSS 8.5 Exploit Intelligence - Recent CVEs / 3h better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a](https://exploit-intel.com/og.png)
Back exploit-intel.com CVE-2026-57998: better-npm-audit OS Command Injection via registry flag [HIGH] CVSS 8.5 Exploit Intelligence - Recent CVEs / 3h better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a
better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a semicolon, pipe, or command substitution executes arbitrary operating system commands with the privileges of the process running the audit.
Default status: unaffected
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
