CVE-2021-42740: Command Injection in shell-quote

shell-quote Updated 02 Oct 2025

Summary

24/05/2022

Disclosed on

CVE-2021-42740

CVE

Yes i

Fix available

Critical

Severity

9.8

CVSS Score

Your scan reports shell-quote 1.6.1. Fixed in 1.7.3.

CVE-2021-42740: Improper Neutralization of Special Elements used in a Command in Shell-quote. Affects shell-quote versions < 1.7.3. Fixed in 1.7.3. How to fix ↓

Also tracked for

node-shell-quote · Debian:12

The same CVE-2021-42740 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Background

The shell-quote package is a Node.js module that provides functions for quoting and unquoting strings for shell commands. It is commonly used to generate command-line arguments for executing shell commands. The package is vulnerable to command injection due to improper neutralization of special elements used in a command. This vulnerability allows an attacker to inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. The incorrect Windows drive letter regex character class allows several shell metacharacters to exist in the space between capital letter Z and lowercase letter a, such as the backtick character.

Vulnerability Detail

The vulnerability in the shell-quote package allows an attacker to execute arbitrary commands by injecting unescaped shell metacharacters. By manipulating the input to the package's quote function, an attacker can bypass command sanitization and execute malicious commands on the host system. This can lead to various security risks, including unauthorized access, data exfiltration, and remote code execution. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.

How To Fix

Latest published version: 1.12.0 as of 22 Oct 2026

npm install shell-quote@1.12.0

Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.

If you need the minimum change

1.7.3

This is the first release that contains the fix.

npm install shell-quote@1.7.3

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

If upgrading to the latest version of the shell-quote package is not immediately feasible, developers can implement input validation and sanitization to mitigate the risk of command injection. It is important to carefully validate and sanitize any user-supplied input that is passed to the shell-quote package's quote function. This can be done by using a whitelist approach, allowing only known safe characters and escaping or rejecting any input that contains potentially dangerous characters.

Conclusion

The shell-quote package before version 1.7.3 for Node.js is vulnerable to command injection, allowing an attacker to execute arbitrary commands on the host system. It is crucial to upgrade to the latest version of the package or implement input validation and sanitization to mitigate the risk. Promptly addressing this vulnerability is essential to ensure the security and integrity of Node.js applications.

See every vulnerability recorded for shell-quote →

FAQ

What is the impact of this vulnerability?

This vulnerability allows an attacker to execute arbitrary commands on the host system, potentially leading to unauthorized access, data exfiltration, and remote code execution.

How can I check if my application is affected?

You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this specific vulnerability in the shell-quote package.

Is there a workaround available?

If upgrading to the latest version of the shell-quote package is not immediately feasible, you can implement input validation and sanitization to mitigate the risk of command injection. Carefully validate and sanitize any user-supplied input that is passed to the shell-quote package's quote function.

Are there any known exploits for this vulnerability?

At the time of this report, there are no known public exploits specifically targeting this vulnerability in the shell-quote package. However, it is important to promptly address and fix this vulnerability to prevent potential exploitation.

Where can I get further support on vulnerability remediation?

For further support and assistance in remediating this vulnerability, you can contact info@devnack.com. Our team of experts can provide guidance and recommendations to help secure your Node.js applications.