Command Injection Vulnerability in node-shell-quote Package
Summary
DEBIAN-CVE-2021-42740: The shell-quote package before 1.7.3 for Node.js allows command injection. Affects node-shell-quote versions < 1.7.3+~1.7.1-1. Fixed in 1.7.3+~1.7.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-shell-quote package is a utility for Node.js that provides functionality to quote shell commands safely. It is commonly used in applications that need to execute shell commands by ensuring that the commands are properly formatted to avoid injection attacks. However, prior to version 1.7.3, the package contained a vulnerability that allowed attackers to inject unescaped shell metacharacters, posing a significant security risk.
Vulnerability Detail
The vulnerability in the node-shell-quote package arises from a regex designed to support Windows drive letters, which incorrectly uses the character class {A-z] instead of the correct {A-Za-z]. This flaw allows an attacker to inject arbitrary commands if the output of the package is passed to a real shell as a quoted argument in an exec() command. The presence of several shell metacharacters between capital letter Z and lowercase letter a can lead to command injection, enabling unauthorized execution of commands.
How To Fix
Minimum fixed version
1.7.3+~1.7.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-shell-quoteTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing untrusted input to the shell commands executed using the node-shell-quote package. Ensure that any input is sanitized and validated before being processed.
Conclusion
The node-shell-quote package has a critical vulnerability that allows for command injection due to improper regex handling. It is essential to update to the latest version to protect your application from potential attacks. Additionally, using tools like Vulert can help monitor your applications for vulnerabilities in real-time.
See every vulnerability recorded for node-shell-quote →
FAQ
node-shell-quote is a Node.js package that helps format shell commands safely to prevent injection attacks.
The vulnerability allows attackers to inject arbitrary commands, which can lead to unauthorized access and control over the system running the application.
All versions prior to 1.7.3 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, ensure that you sanitize and validate all inputs passed to shell commands to mitigate the risk of command injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-shell-quote.
