The better-npm-audit tool versions through 3.11.0 and the 4.0.0-rc.2 prerelease construct an npm audit command by directly embedding the user-supplied --registry option into a command string in src/handlers/handleInput.ts without proper validation or escaping. This command string is then passed to child_process.exec() in index.ts, which executes it in a shell. If the registry value contains shell metacharacters such as semicolons, pipes, or command substitutions, an attacker can execute arbitrary operating system commands with the same privileges as the process running the audit.

An attacker who can control the --registry option can execute arbitrary OS commands on the system with the privileges of the better-npm-audit process. This can lead to unauthorized command execution, potentially compromising the host system. The vulnerability has a high severity with a CVSS 4.0 score of 8.5, reflecting high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input for the --registry option or running better-npm-audit in environments where untrusted users can influence this parameter. Monitor vendor channels for official patches or updates addressing this issue.