GHSA-5vwr-qchf-q4pf
Fix: cdxgen/cdxgen#4059GHSA-5vwr-qchf-q4pf is a remote code execution vulnerability in @cyclonedx/cdxgen. O3 Security confirms whether GHSA-5vwr-qchf-q4pf is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
@cyclonedx/cdxgennpmDescription
Summary
A command injection vulnerability existed in the Maven scanning flow of cdxgen before version 12.4.3.
When cdxgen scanned an attacker-controlled Maven project, repository-controlled paths could be used in the Maven command construction. In affected versions, some Maven invocations were executed with shell: true. A directory name containing shell metacharacters could therefore be interpreted by the shell instead of being treated only as a filesystem path.
This could allow an attacker who controls a scanned repository to execute commands in the cdxgen process context.
The issue affected both the CLI and server mode. The issue is patched in 12.4.3.
Affected asset
- Project: cdxgen
- Tested version: 12.4.1
- Mode tested: server mode
- Endpoint:
POST /sbom - Scanner path: Java / Maven project scanning
Patch
Version 12.4.3 includes hardening for this issue with PR #4059
The patch adds multiple mitigations:
- Maven command invocations no longer use unconditional shell execution on POSIX platforms.
- Bazel command invocation was similarly changed away from unconditional shell execution.
- Windows compatibility is preserved using
shell: isWinwhere needed. safeSpawnSyncnow blocksshell: trueinvocations when the command or direct argument values contain shell metacharacters.- cdxgen does not validate or sanitise every nested directory. The threat model is updated to clarify mitigation scope.
Workarounds
The recommended remediation is to upgrade to 12.4.3 or later.
If immediate upgrade is not possible:
- Do not run cdxgen server mode on untrusted networks.
- Do not expose POST /sbom to unauthenticated or untrusted clients.
- Avoid scanning untrusted Java/Maven repositories.
- Run cdxgen inside a locked-down container or sandbox.
- Remove sensitive environment variables from the cdxgen process environment.
- Use least-privilege filesystem mounts.
- Restrict outbound network access where possible.
Use cdxgen secure/dry-run modes where suitable to inspect planned operations before performing scans. Configure host and command allowlists where applicable, such as:
- CDXGEN_SERVER_ALLOWED_HOSTS
- CDXGEN_GIT_ALLOWED_HOSTS
- CDXGEN_ALLOWED_COMMANDS
- CDXGEN_SECURE_MODE=true
These mitigations reduce exposure but do not fully address the vulnerable command construction in affected versions.
Threat model clarification
The mitigation added in 12.4.3 applies to the cdxgen process boundary. Specifically, cdxgen now hardens command, option, and path values that cdxgen itself passes to external processes through safeSpawnSync.
This does not mean cdxgen sanitizes every nested path, module name, generated path, or project-controlled value that an external build tool later discovers and interprets inside its own process. Once cdxgen safely invokes Maven, Gradle, Bazel, SBT, or another build tool, that tool’s internal behavior remains a separate trust boundary.
In scope for this fix:
- command and argument values passed directly by cdxgen to child processes;
- cdxgen’s own use of shell: true;
- Maven/Bazel command invocation paths controlled by cdxgen.
Out of scope for this specific mitigation:
- arbitrary nested paths later discovered by Maven itself;
- Maven plugin behavior;
- Maven lifecycle hooks;
- build-tool-specific interpretation of project files after cdxgen has launched the tool.
This residual risk is documented in the cdxgen threat model and is why untrusted project scans should still be run in sandboxed, least-privileged environments.
Detection
Possible indicators of exploitation or probing include:
- Maven module directories containing shell metacharacters such as:
;
&
|
<
>
$
backticks
newlines
- Logs showing settings.xml or pom.xml discovered in suspicious paths.
- Unexpected files created outside the scanned repository during a Java/Maven scan.
- Unexpected child process behavior during cdxgen server scans.
- cdxgen server receiving POST /sbom requests for attacker-controlled Git URLs.
Example suspicious path pattern:
evil;cd${IFS}..;cd${IFS}..;printf${IFS}...>...;#
Credits
Reported-By: @aleff-github
Resources
- Patch PR - https://github.com/cdxgen/cdxgen/pull/4059
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @cyclonedx/cdxgen | all versions | 12.4.3 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @cyclonedx/cdxgen. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update @cyclonedx/cdxgen to 12.4.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5vwr-qchf-q4pf is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-5vwr-qchf-q4pf is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-5vwr-qchf-q4pf. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-5vwr-qchf-q4pf in your dependencies?
O3 detects GHSA-5vwr-qchf-q4pf across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.