CVE-2021-21384: Null characters not escaped in shescape
shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using Shescape to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-21384?
CVE-2021-21384 is a vulnerability in the shescape package for JavaScript that allows shell injection if a special character is inserted into the payload.
How does CVE-2021-21384 impact users?
CVE-2021-21384 impacts users of shescape versions up to 1.1.3 who are using the package to defend against shell injection vulnerabilities, as it can still be exploited if a special character is inserted into the payload.
What software versions are affected by CVE-2021-21384?
Versions of shescape up to and including 1.1.3 are affected by CVE-2021-21384.
How severe is CVE-2021-21384?
CVE-2021-21384 has a severity rating of 7.8 (high).
How can I fix CVE-2021-21384?
To fix CVE-2021-21384, users should upgrade to shescape version 1.1.3 or later.