The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex desig...
Résumé
Improper Neutralization of Special Elements used in a Command in Shell-quote
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2021-42740 node-shell-quote Corrigé dans: 1.7.3+~1.7.1-1
- Ubuntu UBUNTU-CVE-2021-42740 node-shell-quote
Références
- advisory nvd.nist.gov
- advisory npmjs.com
- advisory github.com
- package github.com
- patch github.com
- web github.com
- web github.com