{
  "title": "@cyclonedx/cdxgen Maven Scanner Command Injection",
  "summary": "CycloneDX cdxgen before 12.4.3 could execute shell metacharacters from repository-controlled Maven module paths when scanning attacker-controlled projects, putting developer workstations and CI SBOM runners at risk.",
  "date": "2026-06-26",
  "severity": "high",
  "tags": [
    "cyclonedx",
    "cdxgen",
    "sbom",
    "maven",
    "developer-tooling"
  ],
  "sources_count": 3,
  "indicators": {
    "slug": "cyclonedx-cdxgen-maven-scanning-command-injection",
    "since": "2026-06-26T19:47:24Z",
    "until": "not_applicable",
    "ecosystem": "npm",
    "cves": [],
    "cwes": [],
    "advisoryIds": [],
    "products": [
      "@cyclonedx/cdxgen"
    ],
    "packages": [
      "@cyclonedx/cdxgen"
    ],
    "versions": [
      "@cyclonedx/cdxgen < 12.4.3"
    ],
    "affectedVersions": [
      "@cyclonedx/cdxgen < 12.4.3"
    ],
    "fixedVersions": [],
    "files": [
      "package.json",
      "package-lock.json",
      "pnpm-lock.yaml",
      "yarn.lock",
      ".github/workflows"
    ],
    "paths": [],
    "services": [],
    "domains": [],
    "urls": [
      "https://github.com/cdxgen/cdxgen/security/advisories/GHSA-5vwr-qchf-q4pf",
      "https://github.com/cdxgen/cdxgen/pull/4059"
    ],
    "ips": [],
    "hashes": [],
    "processPatterns": [
      "cdxgen",
      "--type maven",
      "-t maven"
    ],
    "networkPatterns": [],
    "telemetrySelectors": []
  }
}