Vulnerability Details CVE-2021-21384
shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 38.2%
CVSS Severity
CVSS v3 Score 6.3
CVSS v2 Score 4.6
References
- https://github.com/ericcornelissen/shescape/commit/07a069a66423809cbedd61d980c11ca44a29ea2b
- https://github.com/ericcornelissen/shescape/releases/tag/v1.1.3
- https://github.com/ericcornelissen/shescape/security/advisories/GHSA-f2rp-38vg-j3gh
- https://www.npmjs.com/package/shescape
- https://github.com/ericcornelissen/shescape/commit/07a069a66423809cbedd61d980c11ca44a29ea2b
- https://github.com/ericcornelissen/shescape/releases/tag/v1.1.3
- https://github.com/ericcornelissen/shescape/security/advisories/GHSA-f2rp-38vg-j3gh
- https://www.npmjs.com/package/shescape
Products affected by CVE-2021-21384
-
cpe:2.3:a:shescape_project:shescape:0.1.0
-
cpe:2.3:a:shescape_project:shescape:0.2.0
-
cpe:2.3:a:shescape_project:shescape:0.2.1
-
cpe:2.3:a:shescape_project:shescape:0.3.0
-
cpe:2.3:a:shescape_project:shescape:0.3.1
-
cpe:2.3:a:shescape_project:shescape:0.4.0
-
cpe:2.3:a:shescape_project:shescape:0.4.1
-
cpe:2.3:a:shescape_project:shescape:1.0.0
-
cpe:2.3:a:shescape_project:shescape:1.1.0
-
cpe:2.3:a:shescape_project:shescape:1.1.1
-
cpe:2.3:a:shescape_project:shescape:1.1.2
-
cpe:2.3:o:microsoft:windows:-
-
cpe:2.3:o:opengroup:unix:-