CVE-2026-57998: Jeemok Better-Npm-Audit

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a semicolon, pipe, or command substitution executes arbitrary operating system commands with the privileges of the process running the audit.

Affected products

• Jeemok Better-Npm-Audit: up to and including 3.11.0; version 4.0.0-rc.2 only

Published 2026-08-22. Last modified 2026-09-24.