CVE-2021-42740

Aliases:GHSA-g4rg-993r-mgx7DEBIAN-CVE-2021-42740CGA-57fp-cvh2-3jwpCGA-23f3-j2c3-gj43CGA-3mc8-7mp3-22xqCGA-5qv3-c2f6-r36vCGA-h322-8854-mjxwCGA-hg6c-7m63-5976CGA-mm59-7363-jrv9CGA-v7j9-ph6f-4ppjCGA-xj8h-x4mc-63fq
Advisory lineage Upstream: 0 Downstream: 6
Modified
Published: 21 Oct 2021, 14:46
Last modified:04 Aug 2024, 03:38

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
4.22% LOW
4% probability -1.14%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

21 Oct 2021, 14:46
Published
Vulnerability first disclosed
04 Aug 2024, 03:38
Last Modified
Vulnerability information updated

Description

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 4.22%• Percentile: 91%

Techniques & Countermeasures

  • CWE-77•Improper Neutralization of Special Elements used in a Command ('Command Injection')

    The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Affected Systems

  • chainguard•jitsucom-jitsu

    < 0

  • chainguard•py3.10-captum

    < 0.9.0-r1

  • chainguard•py3.11-captum

    < 0.9.0-r1

  • chainguard•py3.12-captum

    < 0.9.0-r1

  • chainguard•py3.13-captum

    < 0.9.0-r1

  • wolfi•jitsucom-jitsu

    < 0

  • debian•node-shell-quote

    < 1.7.3+~1.7.1-1 | < 1.7.3+~1.7.1-1 | < 1.7.3+~1.7.1-1

  • Npm•shell-quote

    ≥ 1.6.3, < 1.7.3

  • shell-quote_project•shell-quote

    < 1.7.3

References (8)