cdxgen repository configuration can execute commands despite scan safeguards

The November 6 batch concerns the scanner’s trust boundary when it processes an untrusted repository. It is not a claim that the published cdxgen package was malicious. The maintainer rates command execution and parser denial of service moderate, and the symlink and redirect issues low. This event is rated L3 because public demonstrations show repository-controlled code executing in a CI/developer security tool despite its documented safeguards. No actual victim total or confirmed exploitation is established.

Configuration is loaded from cdxgen’s current working directory. The advisory describes four execution routes: a .NET evidence helper accepting dosaiCommand, Scala evidence accepting scalasem-command from 13.4.0 onward, dynamic tracing accepting traceCmd and sandbox changes, and yargs 18 loading extends inside the scanner process. The last route affects versions using yargs 18 from 12.0.0. Running from a separate trusted directory avoids loading the target checkout’s configuration; it does not make every other scanning operation safe.

The other three issues have distinct prerequisites. CrewAI parsing can block the Node.js event loop. A final-component output symlink can corrupt another file the scanner user can write, including outside Node permission-model paths, but the written content is the generated BOM. Git redirects require a redirect-capable allowlisted host; unauthenticated server clients can choose the initial repository URL. This can enable internal-host probing, internal-repository SBOM disclosure or resource exhaustion; outside secure mode, configured Git HTTP headers may also reach the redirect target.

All four advisories identify @cyclonedx/cdxgen 12.9.1 as fixed. They list no patched @cdxgen/cdxgen 13.x version and say its fixes will ship in 13.7.0. The 13.7.0 release URL returned 404 during verification. Do not treat the planned release or a merged patch as an available fixed artifact. No version checker is provided because the two package names have different affected ranges and 13.x remediation is pending.

The fix restricts project-config keys and resolves allowed paths through symlinks, replaces unsafe output symlinks, uses bounded parsing and disables Git redirects when a host allowlist or secure mode applies. The earlier bundled-Node Brotli issue remains tracked in the Node.js October incident; it is a separate flaw and fixing it alone does not address this batch.