Homepage

org.webjars.npm:shell-quote@1.7.2 vulnerabilities

  • latest version

    1.8.1

  • latest non vulnerable version

    1.8.1

  • first published

    9 years ago

  • latest version published

    1 years ago

  • licenses detected

  • package manager

    View on Maven Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.npm:shell-quote package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Remote Code Execution (RCE)

    org.webjars.npm:shell-quote is a package used to quote and parse shell commands.

    Affected versions of this package are vulnerable to Remote Code Execution (RCE). An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

    How to fix Remote Code Execution (RCE)?

    Upgrade org.webjars.npm:shell-quote to version 1.7.4 or higher.

    [,1.7.4)
    Go back to all versions of this package