CVE-2026-57998 - Exploits & Severity

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

better-npm-audit through version 3.11.0 and the 4.0.0-rc.2 prerelease contains a command injection vulnerability in src/handlers/handleInput.ts. The --registry option is interpolated into a command string without validation or quoting and passed to child_process.exec(), which spawns a shell. A registry value containing shell metacharacters such as semicolons, pipes, or command substitution sequences can execute arbitrary operating system commands.

A local user can trigger this vulnerability by running better-npm-audit with a malicious --registry option, allowing them to execute arbitrary operating system commands with the privileges of the process running the audit, including reading sensitive files, modifying files, or executing code.

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Yes, a patch is available. See

Update better-npm-audit to a patched version beyond 3.11.0 and beyond 4.0.0-rc.2. Additionally, validate and sanitize all user-supplied inputs, particularly the --registry option, and avoid passing user-controlled data directly to shell execution functions. Consider using safer alternatives to child_process.exec() that do not spawn shells, such as child_process.execFile() with an array of arguments.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD published the first details for CVE-2026-57998

A CVSS base score of 7.8 has been assigned.

Feedly found the first article mentioning CVE-2026-57998 . See article

GitHub Advisories released a security advisory .

CVE-2026-57998: better-npm-audit OS Command Injection via registry flag [HIGH] CVSS 8.5

CVE-2026-57998 | jeemok better-npm-audit up to 3.11.0/4.0.0-rc.2 Input handleInput.ts child_process.exec registry os command injection

CVE-2026-57998 - better-npm-audit OS Command Injection via registry flag

CVE-2026-57998: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in jeemok better-npm-audit

Collect, analyze, and vulnerability reports faster using AI