CVE-2016-10541: OS Command Injection
Affected versions of shell-quote do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments.
Proof of Concept:
The following characters are not escaped properly: >,;,{,}
Bash has a neat but not well known feature known as "Bash Brace Expansion", wherein a sub-command can be executed without spaces by running it between a set of {} and using the , instead of to seperate arguments. Because of this, full command injection is possible even though it was initially thought to be impossible.
const quote = require('shell-quote').quote; console.log(quote(['a;{echo,test,123,234}'])); // Actual "a;{echo,test,123,234}" // Expected "a\;\{echo,test,123,234\}" // Functional Equivalent "a; echo 'test' '123' '1234'"
Recommendation
Update to version 1.6.1 or later.
Other sources
The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10541?
CVE-2016-10541 is rated as a moderate severity vulnerability due to its potential for code injection.
How do I fix CVE-2016-10541?
To fix CVE-2016-10541, update the 'shell-quote' npm package to version 1.6.1 or later.
Which versions of the shell-quote are affected by CVE-2016-10541?
Versions of the shell-quote npm package prior to 1.6.1 are affected by CVE-2016-10541.
What impact does CVE-2016-10541 have on applications?
CVE-2016-10541 could allow a malicious user to perform code injection in applications that depend on the vulnerable shell-quote module.
Is CVE-2016-10541 limited to specific environments?
CVE-2016-10541 affects any application using the vulnerable versions of the shell-quote npm module regardless of the environment.