CVE-2026-57998: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in jeemok better-npm-audit

The vulnerability exists because better-npm-audit constructs its npm audit command by embedding the user-supplied --registry option directly into a command string in src/handlers/handleInput.ts without sanitization. This string is then passed to child_process.exec() in index.ts, which executes it in a shell. If the registry value contains shell metacharacters such as semicolons, pipes, or command substitutions, arbitrary OS commands can be executed with the same privileges as the better-npm-audit process. Affected versions include all versions up to and including 3.11.0 and the 4.0.0-rc.2 prerelease.

Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the better-npm-audit process. This can lead to full system compromise depending on the privileges of the user running the tool. The CVSS 4.0 score is 8.5 (high severity), reflecting the potential for significant impact without requiring privileges but requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid passing untrusted input to the --registry option or avoid using affected versions. Consider running the tool with minimal privileges to reduce impact.