CVE-2021-42740: shell-quote_project shell-quote
Vulnerability summary
CVE-2021-42740 is a critical (CVSS 9.8) vulnerability in shell-quote_project shell-quote. EPSS estimates a 4.22% chance of exploitation in the next 30 days, higher than 91% of scored vulnerabilities.
Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 4% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 5Timeline
- 21-10-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
CVSS metrics
7 scores · 6 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · NpmEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.22%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.22% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard5 products
- jitsucom-jitsuAll versions (No fix recorded)
- py3.10-captum< 0.9.0-r1
- py3.11-captum< 0.9.0-r1
- py3.12-captum< 0.9.0-r1
- py3.13-captum< 0.9.0-r1
Debian1 product
- node-shell-quote< 1.7.3+~1.7.1-1
Npm1 product
- shell-quote≥ 1.6.3, < 1.7.3
Shell-quote_project1 product
- shell-quote< 1.7.3
Ubuntu1 product
- node-shell-quoteAll versions (No fix recorded)
Wolfi1 product
- jitsucom-jitsuAll versions (No fix recorded)
6 vendors · 10 products
References
10 links- github.com/substack/node-shell-quote/blob/master/CHANGELOG.mdX Refsource CONFIRMREPORTAdvisoryThird Party Advisory
- github.com/substack/node-shell-quote/commit/5799416ed454aa4ec9afafc895b4e31760ea1abeX Refsource CONFIRMREPORTFIXPatchThird Party Advisory
