Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Older versions of shescape still vulnerable to shell injection

CVE-2021-21384 · published 5 years ago
Summary

Older versions of the shescape JavaScript package may not protect against shell injection attacks. This means that if an attacker can inject malicious code, they may be able to execute unintended commands. Update to version 1.1.3 or later to fix this issue.

What to do
  • Update GitHub Actions shescape to version 1.1.3.
  • Update shescape_project shescape to version 1.1.3 or later.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions shescape < 1.1.3
Fix: upgrade to 1.1.3
– shescape_project shescape < 1.1.3
cpe:2.3:a:shescape_project:shescape:*:*:*:*:*:node.js:*:*
Original advisory text
shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection...
shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published19 Mar 2021
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-f2rp-38vg-j3gh · GHSA
CVE-2021-21384 · NVD
Track software like this
Free during beta