CVE-2021-21384: Null characters not escaped in shescape
Summary
CVE-2021-21384: Null characters not escaped. Affects shescape versions < 1.1.3. Fixed in 1.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shescape is an npm package used for defending against shell injection attacks. It provides a function called 'quote' that escapes special characters in a shell command. However, prior to version 1.1.3, shescape did not properly escape null characters, leaving the system vulnerable to shell injection attacks if an attacker managed to insert a null character into the payload.
Vulnerability Detail
The vulnerability in shescape allows an attacker to bypass shell injection defenses by inserting null characters into the payload. This can lead to arbitrary command execution and potential compromise of the system. The impact is particularly severe on Windows systems. An example payload demonstrating the vulnerability is provided in the vulnerability details.
How To Fix
Latest published version: 3.0.2 as of 23 Oct 2026
npm install shescape@3.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.3
This is the first release that contains the fix.
npm install shescape@1.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually strip out null characters from the payload using the following code:
const sanitizedPayload = payload.replace(/\u{0}/gu, '');
Conclusion
The vulnerability in shescape that allowed bypassing shell injection defenses by inserting null characters has been fixed in version 1.1.3. It is recommended to upgrade to this version or later to ensure the security of your system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for shescape →
FAQ
The vulnerability allows an attacker to bypass shell injection defenses and execute arbitrary commands, potentially leading to system compromise.
You can fix this vulnerability by upgrading to shescape version 1.1.3 or later.
Yes, you can manually strip out null characters from the payload using the provided code snippet.
No, only versions prior to 1.1.3 are affected. Upgrading to version 1.1.3 or later will fix the vulnerability.
You can find more information about this vulnerability in the provided vulnerability details or by contacting the package maintainers.
References
Related vulnerabilities
Recent vulnerabilities recorded for shescape.
