CVE-2021-21384

Katalog CVE

CVSS 7.8 · High EPSS 0,58%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada shescape project shescape. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.

Rincian

Terbit di NVD

19 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ericcornelissen/shescape/commit/07a069a66423809cbedd61d980c11ca44a29ea2b patch · advisory pihak ketiga
• https://github.com/ericcornelissen/shescape/releases/tag/v1.1.3 release notes · advisory pihak ketiga
• https://github.com/ericcornelissen/shescape/security/advisories/GHSA-f2rp-38vg-j3gh exploit · advisory pihak ketiga
• https://www.npmjs.com/package/shescape product