Shell Quote
Approved changes feed: RSS · Atom
cpe:2.3:a:shell-quote_project:shell-quote:*:*:*:*:*:node.js:*:*part: a version: * update: *
| Vendor | Shell Quote Project (ba4fa9ec-876f-5b71-ac5c-b612191a3649) |
|---|---|
| Product | Shell Quote (bb3631c1-ab25-5bb9-aefb-7e9ff5380544) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/node-shell-quote |
purl2cpe | 2026-06-01 10:12:32.677456 |
pkg:deb/ubuntu/node-shell-quote |
purl2cpe | 2026-06-01 10:12:32.677458 |
pkg:github/substack/node-shell-quote |
purl2cpe | 2026-06-01 10:12:32.677459 |
pkg:maven/org.webjars.npm/shell-quote |
purl2cpe | 2026-06-01 10:12:32.677461 |
pkg:npm/shell-quote |
purl2cpe | 2026-06-01 10:12:32.677462 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-42740 |
vulnerable | 2026-06-08 05:35:22.498897 |
Details available
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Published: 2021-10-21T14:46:08.000Z
Updated: 2024-08-04T03:38:50.098Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-10541 |
vulnerable | 2026-06-08 05:07:25.289515 |
Details available
The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.
Published: 2018-05-31T20:00:00.000Z
Updated: 2024-09-17T03:18:50.154Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.