Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2021-42740: shell-quote can let attackers run commands
CVE-2021-42740 · published 4 years ago
Summary
The shell-quote library used in Node.js projects may insert unexpected characters into command lines, letting an attacker execute their own commands when the output is passed to a system shell. This happens because the pattern that checks Windows drive letters is too broad, allowing special symbols like backticks to slip through. Update the library to version 1.7.3 or later to fix the issue.
What to do
- Update ljharb shell-quote to version 1.7.3.
- Update rootio @rootio/shell-quote to version 1.6.3-root.io.1.
- Update ljharb shell-quote to version 1.6.3-aikido.2.
- Update rootio @rootio/shell-quote to version 1.7.3-root.io.1.
- Update ljharb shell-quote to version 1.7.3-aikido.1.
- Update ljharb shell-quote to version 1.7.2-aikido.1.
- Update rootio @rootio/shell-quote to version 1.7.2-root.io.1.
- Update shell-quote to version 1.7.2-aikido.1.
- Update shell-quote_project shell-quote to version 1.7.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | ljharb | shell-quote |
>= 1.6.3, <= 1.7.2 Fix: upgrade to 1.7.3
|
| – | shell-quote_project | shell-quote |
< 1.7.3 cpe:2.3:a:shell-quote_project:shell-quote:*:*:*:*:*:node.js:*:* |
| Root:npm | rootio | @rootio/shell-quote |
< 1.6.3-root.io.1 < 1.7.3-root.io.1 < 1.7.2-root.io.1 Fix: upgrade to 1.6.3-root.io.1
|
| Ubuntu:Pro:18.04:LTS | canonical | node-shell-quote | All versions |
| Root:npm | ljharb | shell-quote |
< 1.6.3-aikido.2 < 1.7.3-aikido.1 < 1.7.2-aikido.1 Fix: upgrade to 1.6.3-aikido.2
|
| Root:npm | – | shell-quote |
< 1.7.2-aikido.1 Fix: upgrade to 1.7.2-aikido.1
|
Original advisory text
CVE-2021-42740 in shell-quote - Patched by Root
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-42740
- https://github.com/ljharb/shell-quote/commit/5799416ed454aa4ec9afafc895b4e31760e...
- https://github.com/ljharb/shell-quote/blob/master/CHANGELOG.md#173
- https://github.com/advisories/GHSA-g4rg-993r-mgx7
- https://ubuntu.com/security/CVE-2021-42740 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-42740 Third Party Advisory
- https://www.npmjs.com/package/shell-quote Vendor Advisory
- https://github.com/substack/node-shell-quote/blob/master/CHANGELOG.md#173 Third Party Advisory
- https://github.com/substack/node-shell-quote/commit/5799416ed454aa4ec9afafc895b4... Patch Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-77Command Injection
Timeline
Published21 Oct 2021
Updated10 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta