CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-42740

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.076

EPSS Ranking 91.4%

CVSS Severity

CVSS v3 Score 9.8

CVSS v2 Score 7.5

References

Products affected by CVE-2021-42740

Shell-Quote Project » Shell-Quote » Version: 0.0.0

cpe:2.3:a:shell-quote_project:shell-quote:0.0.0
Shell-Quote Project » Shell-Quote » Version: 0.0.1

cpe:2.3:a:shell-quote_project:shell-quote:0.0.1
Shell-Quote Project » Shell-Quote » Version: 0.1.0

cpe:2.3:a:shell-quote_project:shell-quote:0.1.0
Shell-Quote Project » Shell-Quote » Version: 0.1.1

cpe:2.3:a:shell-quote_project:shell-quote:0.1.1
Shell-Quote Project » Shell-Quote » Version: 1.0.0

cpe:2.3:a:shell-quote_project:shell-quote:1.0.0
Shell-Quote Project » Shell-Quote » Version: 1.1.0

cpe:2.3:a:shell-quote_project:shell-quote:1.1.0
Shell-Quote Project » Shell-Quote » Version: 1.2.0

cpe:2.3:a:shell-quote_project:shell-quote:1.2.0
Shell-Quote Project » Shell-Quote » Version: 1.3.0

cpe:2.3:a:shell-quote_project:shell-quote:1.3.0
Shell-Quote Project » Shell-Quote » Version: 1.3.1

cpe:2.3:a:shell-quote_project:shell-quote:1.3.1
Shell-Quote Project » Shell-Quote » Version: 1.3.2

cpe:2.3:a:shell-quote_project:shell-quote:1.3.2
Shell-Quote Project » Shell-Quote » Version: 1.3.3

cpe:2.3:a:shell-quote_project:shell-quote:1.3.3
Shell-Quote Project » Shell-Quote » Version: 1.4.0

cpe:2.3:a:shell-quote_project:shell-quote:1.4.0
Shell-Quote Project » Shell-Quote » Version: 1.4.1

cpe:2.3:a:shell-quote_project:shell-quote:1.4.1
Shell-Quote Project » Shell-Quote » Version: 1.4.2

cpe:2.3:a:shell-quote_project:shell-quote:1.4.2
Shell-Quote Project » Shell-Quote » Version: 1.4.3

cpe:2.3:a:shell-quote_project:shell-quote:1.4.3
Shell-Quote Project » Shell-Quote » Version: 1.5.0

cpe:2.3:a:shell-quote_project:shell-quote:1.5.0
Shell-Quote Project » Shell-Quote » Version: 1.6.0

cpe:2.3:a:shell-quote_project:shell-quote:1.6.0
Shell-Quote Project » Shell-Quote » Version: 1.6.1

cpe:2.3:a:shell-quote_project:shell-quote:1.6.1
Shell-Quote Project » Shell-Quote » Version: 1.6.2

cpe:2.3:a:shell-quote_project:shell-quote:1.6.2
Shell-Quote Project » Shell-Quote » Version: 1.6.3

cpe:2.3:a:shell-quote_project:shell-quote:1.6.3
Shell-Quote Project » Shell-Quote » Version: 1.7.0

cpe:2.3:a:shell-quote_project:shell-quote:1.7.0
Shell-Quote Project » Shell-Quote » Version: 1.7.1

cpe:2.3:a:shell-quote_project:shell-quote:1.7.1
Shell-Quote Project » Shell-Quote » Version: 1.7.2

cpe:2.3:a:shell-quote_project:shell-quote:1.7.2

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-42740

Products

Pricing

Contact Us