An OS command injection vulnerability in better-npm-audit versions up to 3.11.0 and 4.0.0-rc.2 allows for arbitrary command execution via malicious input.

This is an Improper Neutralization of Special Elements used in an OS Command (CWE-78) vulnerability. The application fails to properly sanitize input provided through the registry flag, which is passed directly to the operating system shell.

An attacker successfully exploiting this vulnerability can execute arbitrary commands on the underlying host with the privileges of the user executing the audit tool. A CVSS score of 7.8 highlights the potential for full system compromise, especially in CI/CD pipelines where such tools are frequently used with elevated or sensitive environment access.

Immediate Action: Update the better-npm-audit package to a secure version once available, or remove the package if it is not essential to the development workflow.

Proactive Monitoring: Monitor CI/CD logs for anomalous command execution patterns or unauthorized attempts to manipulate registry settings during audit tasks.

Compensating Controls: Implement strict input validation or use containerized environments with limited privileges to execute auditing tools, thereby reducing the impact of potential command injection.

Public Exploit Available: No (exploit_available: false)

Given the potential for command injection in automated environments, it is critical to address this vulnerability promptly. Organizations should verify their dependency versions and apply the necessary updates to prevent unauthorized command execution during the auditing process.