GHSA-5vwr-qchf-q4pf: @cyclonedx/cdxgen Maven Project Scanning May Allow Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5vwr-qchf-q4pf",
  "modified" : "2026-06-26T19:47:24Z",
  "published" : "2026-06-26T19:47:24Z",
  "aliases" : [ ],
  "summary" : "@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths",
  "details" : "## Summary\n\nA command injection vulnerability existed in the Maven scanning flow of cdxgen before version 12.4.3.\n\nWhen cdxgen scanned an attacker-controlled Maven project, repository-controlled paths could be used in the Maven command construction. In affected versions, some Maven invocations were executed with `shell: true`. A directory name containing shell metacharacters could therefore be interpreted by the shell instead of being treated only as a filesystem path.\n\nThis could allow an attacker who controls a scanned repository to execute commands in the cdxgen process context.\n\nThe issue affected both the CLI and server mode. The issue is patched in `12.4.3`.\n\n## Affected asset\n\n- Project: cdxgen\n- Tested version: 12.4.1\n- Mode tested: server mode\n- Endpoint: `POST /sbom`\n- Scanner path: Java / Maven project scanning\n\n## Patch\n\nVersion 12.4.3 includes hardening for this issue with PR #4059 \n\nThe patch adds multiple mitigations:\n\n- Maven command invocations no longer use unconditional shell execution on POSIX platforms.\n- Bazel command invocation was similarly changed away from unconditional shell execution.\n- Windows compatibility is preserved using `shell: isWin` where needed.\n- `safeSpawnSync` now blocks `shell: true` invocations when the command or direct argument values contain shell metacharacters.\n- cdxgen does not validate or sanitise every nested directory. The threat model is updated to clarify mitigation scope.\n\n## Workarounds\n\nThe recommended remediation is to upgrade to 12.4.3 or later.\n\nIf immediate upgrade is not possible:\n\n- Do not run cdxgen server mode on untrusted networks.\n- Do not expose POST /sbom to unauthenticated or untrusted clients.\n- Avoid scanning untrusted Java/Maven repositories.\n- Run cdxgen inside a locked-down container or sandbox.\n- Remove sensitive environment variables from the cdxgen process environment.\n- Use least-privilege filesystem mounts.\n- Restrict outbound network access where possible.\n\nUse cdxgen secure/dry-run modes where suitable to inspect planned operations before performing scans.\nConfigure host and command allowlists where applicable, such as:\n\n- CDXGEN_SERVER_ALLOWED_HOSTS\n- CDXGEN_GIT_ALLOWED_HOSTS\n- CDXGEN_ALLOWED_COMMANDS\n- CDXGEN_SECURE_MODE=true\n\nThese mitigations reduce exposure but do not fully address the vulnerable command construction in affected versions.\n\n## Threat model clarification\n\nThe mitigation added in 12.4.3 applies to the cdxgen process boundary. Specifically, cdxgen now hardens command, option, and path values that cdxgen itself passes to external processes through safeSpawnSync.\n\nThis does not mean cdxgen sanitizes every nested path, module name, generated path, or project-controlled value that an external build tool later discovers and interprets inside its own process. Once cdxgen safely invokes Maven, Gradle, Bazel, SBT, or another build tool, that tool’s internal behavior remains a separate trust boundary.\n\n### In scope for this fix:\n\n- command and argument values passed directly by cdxgen to child processes;\n- cdxgen’s own use of shell: true;\n- Maven/Bazel command invocation paths controlled by cdxgen.\n\n### Out of scope for this specific mitigation:\n- arbitrary nested paths later discovered by Maven itself;\n- Maven plugin behavior;\n- Maven lifecycle hooks;\n- build-tool-specific interpretation of project files after cdxgen has launched the tool.\n\nThis residual risk is documented in the cdxgen threat model and is why untrusted project scans should still be run in sandboxed, least-privileged environments.\n\n## Detection\n\nPossible indicators of exploitation or probing include:\n\n- Maven module directories containing shell metacharacters such as:\n\n```\n;\n&\n|\n<\n>\n$\nbackticks\nnewlines\n```\n\n- Logs showing settings.xml or pom.xml discovered in suspicious paths.\n- Unexpected files created outside the scanned repository during a Java/Maven scan.\n- Unexpected child process behavior during cdxgen server scans.\n- cdxgen server receiving POST /sbom requests for attacker-controlled Git URLs.\n\nExample suspicious path pattern:\n\n```\nevil;cd${IFS}..;cd${IFS}..;printf${IFS}...>...;#\n```\n\n## Credits\n\nReported-By: @aleff-github \n\n## Resources\n\n- Patch PR - https://github.com/cdxgen/cdxgen/pull/4059",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@cyclonedx/cdxgen"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "12.4.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/cdxgen/cdxgen/security/advisories/GHSA-5vwr-qchf-q4pf"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cdxgen/cdxgen/pull/4059"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/cdxgen/cdxgen"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-78", "CWE-88" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-26T19:47:24Z",
    "nvd_published_at" : null
  }
}