CVE-2021-42740

Katalog CVE

CVSS 9.8 · Critical EPSS 4,2%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada shell-quote project shell-quote. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

Rincian

Terbit di NVD

21 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

4,2% peluang dieksploitasi; lebih tinggi dari 90,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.npmjs.com/package/shell-quote advisory vendor
• https://github.com/substack/node-shell-quote/commit/5799416ed454aa4ec9afafc895b4e31760ea1abe patch · advisory pihak ketiga
• https://github.com/substack/node-shell-quote/blob/master/CHANGELOG.md#173 advisory pihak ketiga