PatchSiren

CycloneDX CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH CycloneDX CVE published 2026-07-08

CVE-2026-55849

CVE-2026-55849 is a high-severity vulnerability in @cyclonedx/cyclonedx-npm, a package used to create CycloneDX Software Bill of Materials from npm projects. The vulnerability affects versions from 2.1.0 before 5.0.0. The CLI passes user-supplied --workspace values to a subshell without proper sanitization when npm_execpath is unset or empty, allowing arbitrary OS command execution with the privileges of [truncated]