CVE-2026-57998

CVE-2026-57998 is a command injection vulnerability in better-npm-audit, a security auditing tool that wraps npm's CLI. The vulnerability stems from unsanitized registry URLs being interpolated into a shell command via child_process.exec() — the --registry flag passes user-controlled input directly into a string that gets executed by the shell. In CI environments running npm audits with custom registry configurations, an attacker who controls the registry value can achieve arbitrary command execution with the privileges of the CI process. This matters fundamentally because of what the tool is, not just what it does. better-npm-audit exists to help developers find vulnerabilities — yet it introduces a high-severity command injection vector. The blast radius extends well beyond what the CVSS 7.8 captures: security tools run in CI pipelines with elevated privileges, long-lived credentials, and network access to registries and deployment targets. When the tool you trust to audit your dependencies becomes the injection point, you've inverted the trust model invisibly. The root cause isn't a missing capability — npm exposes a safe programmatic API, and child_process.execFile() with array arguments has existed since Node.js early versions. The pattern persists because exec() with string interpolation remains the path of least resistance, and the npm ecosystem has never created friction against it. This isn't an isolated failure; it's the same class of vulnerability that recurs across npm tooling and CI helper tools. Each instance gets CVE-assigned, patched individually, and reproduced in the next tool. Audit your CI pipelines for custom --registry configurations or environment variables controlling npm registry URLs. Treat any security tooling that wraps CLI commands as potentially vulnerable to similar injection patterns. The remediation velocity for security tooling is systematically slower than regular dependencies — plan for a longer patch window and consider whether the trust you're placing in these tools matches their maintenance posture.

Reviewed through automated stages and approved by a human before publication.