How severe is GHSA-xrmc-c5cg-rv7x?

GHSA-xrmc-c5cg-rv7x has a CVSS score of 8.8/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by GHSA-xrmc-c5cg-rv7x?

GHSA-xrmc-c5cg-rv7x affects the following packages: safeinstall-cli (npm). Ecosystems affected: npm.

How do I fix GHSA-xrmc-c5cg-rv7x?

Update safeinstall-cli to 0.10.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-xrmc-c5cg-rv7x is resolved across your whole dependency graph.

How do I detect GHSA-xrmc-c5cg-rv7x in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for safeinstall-cli. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-xrmc-c5cg-rv7x if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-xrmc-c5cg-rv7x?

O3 pinpoints whether GHSA-xrmc-c5cg-rv7x is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-xrmc-c5cg-rv7x actively exploited in the wild?

No public exploit code has been indexed for GHSA-xrmc-c5cg-rv7x yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-xrmc-c5cg-rv7x published, and has it been updated?

GHSA-xrmc-c5cg-rv7x was published on July 10, 2026 and was last updated on July 10, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦 npm

GHSA-xrmc-c5cg-rv7x

HIGH

SafeInstall agent guard shell parsing can miss raw package execution

Published

Jul 10, 2026

Updated

Jul 10, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Blast Radius

1 pkg affected

Weekly download volume for affected packages — a proxy for how broadly this vulnerability is deployed.

safeinstall-clinpm

177downloads / week

Description

Summary

SafeInstall CLI through 0.10.1 can fail to recognize some package-manager and registry-runner commands in its agent guard. Case-variant launcher names, leading file-descriptor redirections, and supported shell wrappers with options can cause a raw install command to receive no guard decision. Remote project scaffolding through package-manager create/init commands can also avoid the approval decision used for other registry runners.

Impact

When the SafeInstall guard is installed for a coding agent, a crafted shell command can bypass the intended deny or ask response. The coding agent may then run a package installation or registry-provided scaffolding command without SafeInstall policy evaluation and without SafeInstall enforcing disabled lifecycle scripts.

Exploitation requires a coding agent to act on attacker-influenced instructions and issue the crafted shell command. A successful malicious package or runner can execute with the permissions of the developer account, affecting the confidentiality, integrity, and availability of local source code, credentials, and development resources.

The vulnerability is limited to guard interception. Commands already routed through the SafeInstall CLI continue to receive normal policy evaluation.

Affected versions

safeinstall-cli <= 0.10.1

Patched version

safeinstall-cli 0.10.2

Fix

Version 0.10.2:

normalizes package-manager and wrapper launcher names for detection and rewriting;
parses leading redirections before classifying the command;
handles supported wrapper option arity conservatively and fails closed on ambiguous embedded command syntax;
routes remote create/init scaffolding through the registry-runner approval path;
preserves SafeInstall routing for path-qualified package-manager invocations.

The patch includes a permanent regression corpus, table-driven parser characterization, an independent reference detector, and deterministic fuzz invariants. The integrated release candidate passed 626 tests, package smoke validation, and a one-million-command fuzz campaign with zero invariant violations.

Mitigation

Upgrade to safeinstall-cli 0.10.2 or later.

Until an upgrade is possible, manually review every coding-agent shell command and prevent the agent from invoking package managers or registry runners directly. Running an affected guard does not make raw package-manager execution safe.

Credits

Discovered, reproduced, and remediated by the SafeInstall maintainer during adversarial parser testing.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`safeinstall-cli`	all versions	0.10.2

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for safeinstall-cli. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update safeinstall-cli to 0.10.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-xrmc-c5cg-rv7x is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-xrmc-c5cg-rv7x is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-xrmc-c5cg-rv7x. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Summary SafeInstall CLI through 0.10.1 can fail to recognize some package-manager and registry-runner commands in its agent guard. Case-variant launcher names, leading file-descriptor redirections, and supported shell wrappers with options can cause a raw install command to receive no guard decision. Remote project scaffolding through package-manager create/init commands can also avoid the approval decision used for other registry runners. ## Impact When the SafeInstall guard is installed for a coding agent, a crafted shell command can bypass the intended deny or ask response. The coding

O3 Security · Impact-Aware SCA

Is GHSA-xrmc-c5cg-rv7x in your dependencies?

O3 detects GHSA-xrmc-c5cg-rv7x across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works