194 matches found
-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0x0.icu.anima (0.1.0) +16048 more potentially affected by CVE-2021-42740 via shell-quote (>=1.6.3, <=1.7.2)
shell-quote NPM version =1.6.3, =1.0.1, =1.1.0 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 - 0xgank-tea-child-evening 1.0....
GHSA-G4RG-993R-MGX7 Improper Neutralization of Special Elements used in a Command in Shell-quote
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...
-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0x0.icu.anima (0.1.0) +16048 more potentially affected by CVE-2021-42740 via shell-quote (>=1.6.3, <=1.7.2)
shell-quote NPM version =1.6.3, =1.0.1, =1.1.0 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 - 0xgank-tea-child-evening 1.0....
Command Injection
shell-quote is vulnerable to command injection. An attacker can inject unescaped shell metacharacters through a regex used in exports.quote function in the index.js...
DEBIAN-CVE-2021-42740
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...
Command injection
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...
UBUNTU-CVE-2021-42740
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...
CVE-2021-42740
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...
CVE-2021-42740
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...
CVE-2021-42740
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...
-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0x0.icu.anima (0.1.0) +16048 more potentially affected by CVE-2021-42740 via shell-quote (>=1.6.3, <=1.7.2)
shell-quote NPM version =1.6.3, =1.0.1, =1.1.0 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 - 0xgank-tea-child-evening 1.0....
CVE-2021-42740: Improper Neutralization of Special Elements used in a Command
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...
PT-2021-23668
Name of the Vulnerable Software and Affected Versions shell-quote versions prior to 1.7.3 Description The issue allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a...
shell-quote command injection vulnerability
shell-quote is an open source package. It is used to parse and quote shell commands. A security vulnerability exists in the shell-quote package, which can be exploited by attackers to insert arbitrary code to perform related operations...
@cobalt-engine/cobower (2.0.0), @financial-times/n-heroku-tools (>=6.1.3, <=7.3.0) +435 more potentially affected by CVE-2016-10541 via shell-quote (>=1.3.3, <=1.6.0)
shell-quote NPM version =1.3.3, =6.1.3, =0.0.1, =0.9.0, =0.0.1, =1.0.0, =1.24.1, =2.3.0, =2.1.1, =3.0.0, =0.1.3, =0.1.12 and more Source cves: CVE-2016-10541 Source advisory: OSV:GHSA-QG8P-V9Q4-GH34...
GHSA-QG8P-V9Q4-GH34 Potential Command Injection in shell-quote
Affected versions of shell-quote do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments. Proof of Concept: The following characters are not escaped properly: ,;,, Bash has a neat b...
@cobalt-engine/cobower (2.0.0), @financial-times/n-heroku-tools (>=6.1.3, <=7.3.0) +435 more potentially affected by CVE-2016-10541 via shell-quote (>=1.3.3, <=1.6.0)
shell-quote NPM version =1.3.3, =6.1.3, =0.0.1, =0.9.0, =0.0.1, =1.0.0, =1.24.1, =2.3.0, =2.1.1, =3.0.0, =0.1.3, =0.1.12 and more Source cves: CVE-2016-10541 Source advisory: GHSA-QG8P-V9Q4-GH34...
CVE-2016-10541
The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape "" and "" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection...
CVE-2016-10541
The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape "" and "" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection...
CVE-2016-10541
The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape "" and "" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection...