better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which spawns a shell. A registry value containing shell metacharacters such as a semicolon, pipe, or command substitution executes arbitrary operating system commands with the privileges of the process running the audit.

CVE-2026-57998 affects better-npm-audit versions through 3.11.0 and the 4.0.0-rc.2 prerelease. The vulnerability exists because the tool interpolates the user-supplied --registry option directly into a shell command string in src/handlers/handleInput.ts without any validation or quoting. This string is then passed to child_process.exec() in index.ts, which spawns a shell. An attacker who can control the --registry argument can inject shell metacharacters such as semicolons, pipes, or command substitution sequences to execute arbitrary operating system commands. The injected commands run with the same privileges as the process executing the npm audit. This is a classic OS command injection vulnerability stemming from unsafe use of child_process.exec() with unsanitized user input. A fix has been proposed via a pull request on the GitHub repository.