You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
shell-quote is a package used to quote and parse shell commands.
Affected versions of this package are vulnerable to Remote Code Execution (RCE). An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Affecting Packages/Plugins
Overview
shell-quote is a package used to quote and parse shell commands.
Affected versions of this package are vulnerable to Remote Code Execution (RCE). An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is
{A-z]
instead of the correct{A-Za-z]
. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.Remediation
Upgrade
shell-quote
to version 1.7.3 or higher.References
The text was updated successfully, but these errors were encountered: