Command Injection Vulnerability in shell-quote for Node.js

CVE-2021-42740

What is CVE-2021-42740?

The shell-quote package prior to version 1.7.3 for Node.js is susceptible to command injection due to improper handling of regex designed for Windows drive letters. An attacker can exploit this vulnerability by injecting unescaped shell metacharacters, which can lead to the execution of arbitrary commands when the output is processed by a shell command via exec(). This occurs because the regex incorrectly uses {A-z] instead of {A-Za-z], thus allowing access to several shell metacharacters including harmful characters found in the ASCII range between uppercase and lowercase letters.

References