CVE-2026-57998: Command Injection Vulnerability in better-npm-audit

A command injection vulnerability, CVE-2026-57998, has been identified in better-npm-audit versions up to 3.11.0 and 4.0.0-rc.2. The flaw arises from improper handling of the user-supplied --registry option, allowing attackers to inject arbitrary OS commands via shell metacharacters. This vulnerability can be exploited by local users to execute commands with the privileges of the process running the audit, potentially leading to unauthorized access to sensitive files or system modification. Currently, there is no evidence of public proof-of-concept exploits or confirmed exploitation. A patch is available, and users are advised to update to the latest versions and validate all user inputs. The CVSS base score assigned to this vulnerability is 7.8, indicating a high severity level. The National Vulnerability Database has included this CVE in its dataset as of August 22, 2026.

Key Points: • CVE-2026-57998 affects better-npm-audit versions up to 3.11.0 and 4.0.0-rc.2. • The vulnerability allows command injection through the --registry option, enabling arbitrary command execution. • A patch is available, and users are urged to update and validate inputs to mitigate risks.