The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex desig...
Summary
Improper Neutralization of Special Elements used in a Command in Shell-quote
Original description
The description as published by the source.
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2021-42740 node-shell-quote Fixed in: 1.7.3+~1.7.1-1
- Ubuntu UBUNTU-CVE-2021-42740 node-shell-quote
References
- advisory nvd.nist.gov
- advisory npmjs.com
- advisory github.com
- package github.com
- patch github.com
- web github.com
- web github.com