CVE-2016-10541: OS Command Injection
First published: Thu May 31 2018(Updated: )
Affected versions of `shell-quote` do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments. ## Proof of Concept: The following characters are not escaped properly: `>`,`;`,`{`,`}` Bash has a neat but not well known feature known as "Bash Brace Expansion", wherein a sub-command can be executed without spaces by running it between a set of `{}` and using the `,` instead of ` ` to seperate arguments. Because of this, full command injection is possible even though it was initially thought to be impossible. ``` const quote = require('shell-quote').quote; console.log(quote(['a;{echo,test,123,234}'])); // Actual "a;{echo,test,123,234}" // Expected "a\;\{echo,test,123,234\}" // Functional Equivalent "a; echo 'test' '123' '1234'" ``` ## Recommendation Update to version 1.6.1 or later.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/shell-quote | <1.6.1 | 1.6.1 |
| Node Shell Quote | <1.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-10541?
CVE-2016-10541 is rated as a moderate severity vulnerability due to its potential for code injection.
How do I fix CVE-2016-10541?
To fix CVE-2016-10541, update the 'shell-quote' npm package to version 1.6.1 or later.
Which versions of the shell-quote are affected by CVE-2016-10541?
Versions of the shell-quote npm package prior to 1.6.1 are affected by CVE-2016-10541.
What impact does CVE-2016-10541 have on applications?
CVE-2016-10541 could allow a malicious user to perform code injection in applications that depend on the vulnerable shell-quote module.
Is CVE-2016-10541 limited to specific environments?
CVE-2016-10541 affects any application using the vulnerable versions of the shell-quote npm module regardless of the environment.
- collector/github-advisory
- alias/GHSA-qg8p-v9q4-gh34
- alias/CVE-2016-10541
- agent/weakness
- agent/type
- agent/author
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/npm
- vendor/shell-quote project
- canonical/node shell quote