AIKIDO-2026-10556
@cyclonedx/cdxgen is vulnerable to OS command execution
88
High Risk
This Affects:
@cyclonedx/cdxgenTL;DR
In server mode, cdxgen can clone a remote repository path passed in the request. Before the change, the internal gitClone helper could allow Git to run standard clone-time hook or template materialization behavior that runs host-side scripts while cloning an attacker-influenced repository, which in that server context can lead to arbitrary code execution. The fix supplies Git with -c core.hooksPath=/dev/null and an empty --template=, always sets GIT_TERMINAL_PROMPT=0 for the child process, and in secure server mode also points GIT_CONFIG_GLOBAL to /dev/null so the clone runs without pulling in the prior global config handling path.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@cyclonedx/cdxgen is vulnerable to OS command execution in versions 11.4.2 - 12.2.0.
How to fix this
Upgrade the @cyclonedx/cdxgen library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.