CVE-2026-57998

CVE

Threat entity extracted from intelligence sources

Frequency

4

occurrences

First Seen

August 22, 2026

Last Seen

August 22, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

CVE-2026-57998: Command Injection Vulnerability in better-npm-audit64.5

A command injection vulnerability, CVE-2026-57998, has been identified in better-npm-audit versions up to 3.11.0 and 4.0.0-rc.2. The flaw arises from improper handling of the user-supplied --registry option, allowing attackers to inject arbitrary OS commands via shell metacharacters. This vulnerabil...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

CVE-2026-57998: Command Injection Vulnerability in better-npm-audit

Aug 22·1 sources

Related Articles (4)

CVE-2026-57998 - better-npm-audit OS Command Injection via registry flag Latest Vulnerabilities / 5h CVE ID : CVE-2026-57998 Published : Aug. 22, 2026, 12:26 p.m. 38 minutes ago Description : better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a sh

cvefeed.io·Aug 22

CVE-2026-57998 National Vulnerability Database / 4h better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a semicolon, pipe, or command substitution executes arbitrary operating system

nvd.nist.gov·Aug 22

CVE-2026-57998: better-npm-audit OS Command Injection via registry flag [HIGH] CVSS 8.5 Exploit Intelligence - Recent CVEs / 3h better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a

exploit-intel.com·Aug 22

CVE-2026-57998 - Exploits & Severity

Related Entities

Zero-day Exploit CWE-78 - OS Command Injection T1059 - Command and Scripting Interpreter T1059.004 - Unix Shell Npm OS Command Injection