CVE-2021-42740
highpriority · track · 40EPSS 0.042 · 91 %ileDEEUUSEPSS · scored 2026-10-28
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
- shell-quote project shell-quote< 1.7.3nvdUScpe:2.3:a:shell-quote_project:shell-quote:*:*:*:*:*:*:*:*
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2022-1476SUSE Manager: Mehrere SchwachstellenDeutsch2022-09-19csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in SUSE Manager ausnutzen, um Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuführen, seine Privilegien zu erweitern und einen Denial-of-Service-Zustand zu verursachen.
- WID-SEC-W-2022-1603IBM Tivoli Netcool/OMNIbus: Mehrere SchwachstellenDeutsch2022-10-03csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Tivoli Netcool/OMNIbus ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuführen.
- WID-SEC-W-2023-0809IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2023-03-30csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Informationen falsch darzustellen, einen Denial of Service Zustand herbeizuführen, Sicherheitsvorkehrungen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen oder unbekannte Auswirkungen zu verursachen.
- GHSA-g4rg-993r-mgx7Improper Neutralization of Special Elements used in a Command in Shell-quote2022-05-24ghsa · osvUS
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with `exec()`, an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is `[A-z]` instead of the correct `[A-Za-z]`. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://github.com/substack/node-shell-quote/blob/master/CHANGELOG.md#173cnnvd
- https://github.com/substack/node-shell-quote/commit/5799416ed454aa4ec9afafc895b4e31760ea1abecnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-42740cnnvd
- https://www.auscert.org.au/bulletins/ESB-2022.4655cnnvd
- https://www.npmjs.com/package/shell-quotecnnvd
- https://github.com/substack/node-shell-quote/blob/master/CHANGELOG.md#173enisa_euvd
- https://github.com/substack/node-shell-quote/commit/5799416ed454aa4ec9afafc895b4e31760ea1abeenisa_euvd
- https://www.npmjs.com/package/shell-quoteenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan