CVE catalog

CVE-2021-42740

node-shell-quote: CVE-2021-42740

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
4.22% · Oct 25, 2026

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-shell-quotesid1.12.0-1fixed
Debiannode-shell-quoteforky1.12.0-1fixed
Debiannode-shell-quotetrixie1.7.4+~1.7.1-1+deb13u1fixed
Debiannode-shell-quotetrixie-security1.7.4+~1.7.1-1+deb13u2fixed
Debiannode-shell-quotebookworm1.7.4+~1.7.1-1+deb12u1fixed
Debiannode-shell-quotebookworm-security1.7.4+~1.7.1-1+deb12u1fixed
Ubuntunode-shell-quotepro1.6.1+20160617-git72fb5a8ce29b-1vulnerable
Ubuntunode-shell-quotepro1.6.1+20160617-git72fb5a8ce29b-1ubuntu0.1~esm1vulnerable
Susemgr-daemonmanager proxy module 4.24.2.10-150300.2.9.4fixed
Susepatterns-suse-managermanager proxy module 4.24.2-150300.4.12.2fixed
Susespacecmdmanager proxy module 4.24.2.19-150300.4.27.2fixed
Susespacewalk-backendmanager proxy module 4.24.2.24-150300.4.29.5fixed
Susespacewalk-certs-toolsmanager proxy module 4.24.2.18-150300.3.24.3fixed
Susespacewalk-client-toolsmanager proxy module 4.24.2.20-150300.4.24.3fixed
Susespacewalk-proxymanager proxy module 4.24.2.12-150300.3.21.3fixed
Susespacewalk-webmanager proxy module 4.24.2.29-150300.3.27.3fixed
Susesusemanager-tftpsync-recvmanager proxy module 4.24.2.5-150300.3.6.2fixed
Suseuyuni-common-libsmanager proxy module 4.24.2.7-150300.3.9.2fixed
Susedroolsmanager server module 4.27.17.0-150300.4.6.2fixed
Susehttpcomponents-asyncclientmanager server module 4.24.1.4-150300.3.3.2fixed
Suseimage-sync-formulamanager server module 4.20.1.1661440526.b08d95b-150300.3.3.2fixed
Suseinter-server-syncmanager server module 4.20.2.3-150300.8.22.2fixed
Susepatterns-suse-managermanager server module 4.24.2-150300.4.12.2fixed
Susepy27-compat-saltmanager server module 4.23000.3-150300.7.7.23.2fixed
Susesalt-netapi-clientmanager server module 4.20.20.0-150300.3.9.4fixed
Susesaltboot-formulamanager server module 4.20.1.1661440526.b08d95b-150300.3.12.2fixed
Susespacecmdmanager server module 4.24.2.19-150300.4.27.2fixed
Susespacewalk-adminmanager server module 4.24.2.12-150300.3.15.3fixed
Susespacewalk-backendmanager server module 4.24.2.24-150300.4.29.5fixed
Susespacewalk-certs-toolsmanager server module 4.24.2.18-150300.3.24.3fixed
Susespacewalk-client-toolsmanager server module 4.24.2.20-150300.4.24.3fixed
Susespacewalk-javamanager server module 4.24.2.41-150300.3.43.5fixed
Susespacewalk-searchmanager server module 4.24.2.8-150300.3.12.2fixed
Susespacewalk-webmanager server module 4.24.2.29-150300.3.27.3fixed
Susesubscription-matchermanager server module 4.20.29-150300.6.12.2fixed
Susesusemanagermanager server module 4.24.2.37-150300.3.41.1fixed
Susesusemanager-doc-indexesmanager server module 4.24.2-150300.12.33.4fixed
Susesusemanager-docs_enmanager server module 4.24.2-150300.12.33.2fixed
Susesusemanager-schemamanager server module 4.24.2.24-150300.3.27.3fixed
Susesusemanager-slsmanager server module 4.24.2.27-150300.3.33.4fixed
Suseuyuni-common-libsmanager server module 4.24.2.7-150300.3.9.2fixed
Susemgr-osadmanager proxy module 4.24.2.9-150300.2.12.2fixed
Suserhnlibmanager proxy module 4.24.2.7-150300.4.12.2fixed
Susespacecmdmanager proxy module 4.24.2.21-150300.4.33.2fixed
Susespacewalk-backendmanager proxy module 4.24.2.26-150300.4.35.6fixed
Susespacewalk-certs-toolsmanager proxy module 4.24.2.19-150300.3.27.4fixed
Susespacewalk-client-toolsmanager proxy module 4.24.2.22-150300.4.30.2fixed
Susespacewalk-proxymanager proxy module 4.24.2.13-150300.3.24.2fixed
Susespacewalk-proxy-installermanager proxy module 4.24.2.11-150300.3.14.2fixed
Susespacewalk-webmanager proxy module 4.24.2.32-150300.3.36.4fixed
Susesusemanager-build-keysmanager proxy module 4.215.3.6-150300.3.6.2fixed
Suseuyuni-common-libsmanager proxy module 4.24.2.9-150300.3.14.1fixed
Susecobblermanager server module 4.23.1.2-150300.5.19.1fixed
Susedroolsmanager server module 4.27.17.0-150300.4.9.2fixed
Susegrafana-formulamanager server module 4.20.8.1-150300.3.9.2fixed
Suseinter-server-syncmanager server module 4.20.2.7-150300.8.28.2fixed
Susemgr-osadmanager server module 4.24.2.9-150300.2.12.2fixed
Suseprometheus-formulamanager server module 4.20.7.0-150300.3.17.2fixed
Susepy27-compat-saltmanager server module 4.23000.3-150300.7.7.29.2fixed
Suserhnlibmanager server module 4.24.2.7-150300.4.12.2fixed
Susesalt-netapi-clientmanager server module 4.20.21.0-150300.3.12.4fixed
Susesaltboot-formulamanager server module 4.20.1.1676908681.e90e0b1-150300.3.15.1fixed
Susesmdbamanager server module 4.21.7.11-0.150300.3.12.2fixed
Susespacecmdmanager server module 4.24.2.21-150300.4.33.2fixed
Susespacewalk-adminmanager server module 4.24.2.13-150300.3.18.1fixed
Susespacewalk-backendmanager server module 4.24.2.26-150300.4.35.6fixed
Susespacewalk-certs-toolsmanager server module 4.24.2.19-150300.3.27.4fixed
Susespacewalk-client-toolsmanager server module 4.24.2.22-150300.4.30.2fixed
Susespacewalk-javamanager server module 4.24.2.47-150300.3.58.1fixed
Susespacewalk-searchmanager server module 4.24.2.9-150300.3.15.2fixed
Susespacewalk-webmanager server module 4.24.2.32-150300.3.36.4fixed
Susesupportutils-plugin-susemanagermanager server module 4.24.2.5-150300.3.9.2fixed
Susesusemanagermanager server module 4.24.2.40-150300.3.49.1fixed
Susesusemanager-build-keysmanager server module 4.215.3.6-150300.3.6.2fixed
Susesusemanager-doc-indexesmanager server module 4.24.2-150300.12.39.4fixed
Susesusemanager-docs_enmanager server module 4.24.2-150300.12.39.2fixed
Susesusemanager-schemamanager server module 4.24.2.27-150300.3.35.1fixed
Susesusemanager-slsmanager server module 4.24.2.31-150300.3.43.1fixed
Suseuyuni-common-libsmanager server module 4.24.2.9-150300.3.14.1fixed
Susevirtual-host-gatherermanager server module 4.21.0.24-150300.3.9.2fixed
Susewoodstoxmanager server module 4.24.4.2-150300.3.6.2fixed
Suserelease-notes-susemanager-proxymanager proxy 4.24.2.9-150300.3.43.1fixed
Suserelease-notes-susemanager-proxymanager retail branch server 4.24.2.9-150300.3.43.1fixed
Suserelease-notes-susemanagermanager server 4.24.2.9-150300.3.54.1fixed
Suserelease-notes-susemanager-proxymanager proxy 4.34.3.2-150400.3.9.3fixed
Suserelease-notes-susemanager-proxymanager retail branch server 4.34.3.2-150400.3.9.3fixed
Suserelease-notes-susemanagermanager server 4.34.3.2-150400.3.15.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-shell-quotesourcesid1.7.3+~1.7.1-1not yet assignedNot reported[998418]
Debiannode-shell-quotesourceforky1.7.3+~1.7.1-1not yet assignedNot reported[998418]
Debiannode-shell-quotesourcetrixie1.7.3+~1.7.1-1not yet assignedNot reported[998418]
Debiannode-shell-quotesourcebookworm1.7.3+~1.7.1-1not yet assignedNot reported[998418]
Susemgr-daemonrpmmanager proxy module 4.24.2.10-150300.2.9.4Not reportedSUSE-SU-2022:3314-1Not reported
Susepatterns-suse-managerrpmmanager proxy module 4.24.2-150300.4.12.2Not reportedSUSE-SU-2022:3314-1Not reported
Susespacecmdrpmmanager proxy module 4.24.2.19-150300.4.27.2Not reportedSUSE-SU-2022:3314-1Not reported
Susespacewalk-backendrpmmanager proxy module 4.24.2.24-150300.4.29.5Not reportedSUSE-SU-2022:3314-1Not reported
Susespacewalk-certs-toolsrpmmanager proxy module 4.24.2.18-150300.3.24.3Not reportedSUSE-SU-2022:3314-1Not reported
Susespacewalk-client-toolsrpmmanager proxy module 4.24.2.20-150300.4.24.3Not reportedSUSE-SU-2022:3314-1Not reported
Susespacewalk-proxyrpmmanager proxy module 4.24.2.12-150300.3.21.3Not reportedSUSE-SU-2022:3314-1Not reported
Susespacewalk-webrpmmanager proxy module 4.24.2.29-150300.3.27.3Not reportedSUSE-SU-2022:3314-1Not reported
Susesusemanager-tftpsync-recvrpmmanager proxy module 4.24.2.5-150300.3.6.2Not reportedSUSE-SU-2022:3314-1Not reported
Suseuyuni-common-libsrpmmanager proxy module 4.24.2.7-150300.3.9.2Not reportedSUSE-SU-2022:3314-1Not reported
Susedroolsrpmmanager server module 4.27.17.0-150300.4.6.2Not reportedSUSE-SU-2022:3314-1Not reported
Susehttpcomponents-asyncclientrpmmanager server module 4.24.1.4-150300.3.3.2Not reportedSUSE-SU-2022:3314-1Not reported
Suseimage-sync-formularpmmanager server module 4.20.1.1661440526.b08d95b-150300.3.3.2Not reportedSUSE-SU-2022:3314-1Not reported
Suseinter-server-syncrpmmanager server module 4.20.2.3-150300.8.22.2Not reportedSUSE-SU-2022:3314-1Not reported
Susepatterns-suse-managerrpmmanager server module 4.24.2-150300.4.12.2Not reportedSUSE-SU-2022:3314-1Not reported
Susepy27-compat-saltrpmmanager server module 4.23000.3-150300.7.7.23.2Not reportedSUSE-SU-2022:3314-1Not reported
Susesalt-netapi-clientrpmmanager server module 4.20.20.0-150300.3.9.4Not reportedSUSE-SU-2022:3314-1Not reported
Susesaltboot-formularpmmanager server module 4.20.1.1661440526.b08d95b-150300.3.12.2Not reportedSUSE-SU-2022:3314-1Not reported
Susespacecmdrpmmanager server module 4.24.2.19-150300.4.27.2Not reportedSUSE-SU-2022:3314-1Not reported
Susespacewalk-adminrpmmanager server module 4.24.2.12-150300.3.15.3Not reportedSUSE-SU-2022:3314-1Not reported
Susespacewalk-backendrpmmanager server module 4.24.2.24-150300.4.29.5Not reportedSUSE-SU-2022:3314-1Not reported
Susespacewalk-certs-toolsrpmmanager server module 4.24.2.18-150300.3.24.3Not reportedSUSE-SU-2022:3314-1Not reported
Susespacewalk-client-toolsrpmmanager server module 4.24.2.20-150300.4.24.3Not reportedSUSE-SU-2022:3314-1Not reported
Susespacewalk-javarpmmanager server module 4.24.2.41-150300.3.43.5Not reportedSUSE-SU-2022:3314-1Not reported
Susespacewalk-searchrpmmanager server module 4.24.2.8-150300.3.12.2Not reportedSUSE-SU-2022:3314-1Not reported
Susespacewalk-webrpmmanager server module 4.24.2.29-150300.3.27.3Not reportedSUSE-SU-2022:3314-1Not reported
Susesubscription-matcherrpmmanager server module 4.20.29-150300.6.12.2Not reportedSUSE-SU-2022:3314-1Not reported
Susesusemanagerrpmmanager server module 4.24.2.37-150300.3.41.1Not reportedSUSE-SU-2022:3314-1Not reported
Susesusemanager-doc-indexesrpmmanager server module 4.24.2-150300.12.33.4Not reportedSUSE-SU-2022:3314-1Not reported
Susesusemanager-docs_enrpmmanager server module 4.24.2-150300.12.33.2Not reportedSUSE-SU-2022:3314-1Not reported
Susesusemanager-schemarpmmanager server module 4.24.2.24-150300.3.27.3Not reportedSUSE-SU-2022:3314-1Not reported
Susesusemanager-slsrpmmanager server module 4.24.2.27-150300.3.33.4Not reportedSUSE-SU-2022:3314-1Not reported
Suseuyuni-common-libsrpmmanager server module 4.24.2.7-150300.3.9.2Not reportedSUSE-SU-2022:3314-1Not reported
Susemgr-osadrpmmanager proxy module 4.24.2.9-150300.2.12.2Not reportedSUSE-SU-2023:0592-1Not reported
Suserhnlibrpmmanager proxy module 4.24.2.7-150300.4.12.2Not reportedSUSE-SU-2023:0592-1Not reported
Susespacecmdrpmmanager proxy module 4.24.2.21-150300.4.33.2Not reportedSUSE-SU-2023:0592-1Not reported
Susespacewalk-backendrpmmanager proxy module 4.24.2.26-150300.4.35.6Not reportedSUSE-SU-2023:0592-1Not reported
Susespacewalk-certs-toolsrpmmanager proxy module 4.24.2.19-150300.3.27.4Not reportedSUSE-SU-2023:0592-1Not reported
Susespacewalk-client-toolsrpmmanager proxy module 4.24.2.22-150300.4.30.2Not reportedSUSE-SU-2023:0592-1Not reported
Susespacewalk-proxyrpmmanager proxy module 4.24.2.13-150300.3.24.2Not reportedSUSE-SU-2023:0592-1Not reported
Susespacewalk-proxy-installerrpmmanager proxy module 4.24.2.11-150300.3.14.2Not reportedSUSE-SU-2023:0592-1Not reported
Susespacewalk-webrpmmanager proxy module 4.24.2.32-150300.3.36.4Not reportedSUSE-SU-2023:0592-1Not reported
Susesusemanager-build-keysrpmmanager proxy module 4.215.3.6-150300.3.6.2Not reportedSUSE-SU-2023:0592-1Not reported
Suseuyuni-common-libsrpmmanager proxy module 4.24.2.9-150300.3.14.1Not reportedSUSE-SU-2023:0592-1Not reported
Susecobblerrpmmanager server module 4.23.1.2-150300.5.19.1Not reportedSUSE-SU-2023:0592-1Not reported
Susedroolsrpmmanager server module 4.27.17.0-150300.4.9.2Not reportedSUSE-SU-2023:0592-1Not reported
Susegrafana-formularpmmanager server module 4.20.8.1-150300.3.9.2Not reportedSUSE-SU-2023:0592-1Not reported
Suseinter-server-syncrpmmanager server module 4.20.2.7-150300.8.28.2Not reportedSUSE-SU-2023:0592-1Not reported
Susemgr-osadrpmmanager server module 4.24.2.9-150300.2.12.2Not reportedSUSE-SU-2023:0592-1Not reported
Suseprometheus-formularpmmanager server module 4.20.7.0-150300.3.17.2Not reportedSUSE-SU-2023:0592-1Not reported
Susepy27-compat-saltrpmmanager server module 4.23000.3-150300.7.7.29.2Not reportedSUSE-SU-2023:0592-1Not reported
Suserhnlibrpmmanager server module 4.24.2.7-150300.4.12.2Not reportedSUSE-SU-2023:0592-1Not reported
Susesalt-netapi-clientrpmmanager server module 4.20.21.0-150300.3.12.4Not reportedSUSE-SU-2023:0592-1Not reported
Susesaltboot-formularpmmanager server module 4.20.1.1676908681.e90e0b1-150300.3.15.1Not reportedSUSE-SU-2023:0592-1Not reported
Susesmdbarpmmanager server module 4.21.7.11-0.150300.3.12.2Not reportedSUSE-SU-2023:0592-1Not reported
Susespacecmdrpmmanager server module 4.24.2.21-150300.4.33.2Not reportedSUSE-SU-2023:0592-1Not reported
Susespacewalk-adminrpmmanager server module 4.24.2.13-150300.3.18.1Not reportedSUSE-SU-2023:0592-1Not reported
Susespacewalk-backendrpmmanager server module 4.24.2.26-150300.4.35.6Not reportedSUSE-SU-2023:0592-1Not reported
Susespacewalk-certs-toolsrpmmanager server module 4.24.2.19-150300.3.27.4Not reportedSUSE-SU-2023:0592-1Not reported
Susespacewalk-client-toolsrpmmanager server module 4.24.2.22-150300.4.30.2Not reportedSUSE-SU-2023:0592-1Not reported
Susespacewalk-javarpmmanager server module 4.24.2.47-150300.3.58.1Not reportedSUSE-SU-2023:0592-1Not reported
Susespacewalk-searchrpmmanager server module 4.24.2.9-150300.3.15.2Not reportedSUSE-SU-2023:0592-1Not reported
Susespacewalk-webrpmmanager server module 4.24.2.32-150300.3.36.4Not reportedSUSE-SU-2023:0592-1Not reported
Susesupportutils-plugin-susemanagerrpmmanager server module 4.24.2.5-150300.3.9.2Not reportedSUSE-SU-2023:0592-1Not reported
Susesusemanagerrpmmanager server module 4.24.2.40-150300.3.49.1Not reportedSUSE-SU-2023:0592-1Not reported
Susesusemanager-build-keysrpmmanager server module 4.215.3.6-150300.3.6.2Not reportedSUSE-SU-2023:0592-1Not reported
Susesusemanager-doc-indexesrpmmanager server module 4.24.2-150300.12.39.4Not reportedSUSE-SU-2023:0592-1Not reported
Susesusemanager-docs_enrpmmanager server module 4.24.2-150300.12.39.2Not reportedSUSE-SU-2023:0592-1Not reported
Susesusemanager-schemarpmmanager server module 4.24.2.27-150300.3.35.1Not reportedSUSE-SU-2023:0592-1Not reported
Susesusemanager-slsrpmmanager server module 4.24.2.31-150300.3.43.1Not reportedSUSE-SU-2023:0592-1Not reported
Suseuyuni-common-libsrpmmanager server module 4.24.2.9-150300.3.14.1Not reportedSUSE-SU-2023:0592-1Not reported
Susevirtual-host-gathererrpmmanager server module 4.21.0.24-150300.3.9.2Not reportedSUSE-SU-2023:0592-1Not reported
Susewoodstoxrpmmanager server module 4.24.4.2-150300.3.6.2Not reportedSUSE-SU-2023:0592-1Not reported
Suserelease-notes-susemanager-proxyrpmmanager proxy 4.24.2.9-150300.3.43.1Not reportedSUSE-SU-2022:3313-1Not reported
Suserelease-notes-susemanager-proxyrpmmanager retail branch server 4.24.2.9-150300.3.43.1Not reportedSUSE-SU-2022:3313-1Not reported
Suserelease-notes-susemanagerrpmmanager server 4.24.2.9-150300.3.54.1Not reportedSUSE-SU-2022:3313-1Not reported
Suserelease-notes-susemanager-proxyrpmmanager proxy 4.34.3.2-150400.3.9.3Not reportedSUSE-SU-2022:3761-1Not reported
Suserelease-notes-susemanager-proxyrpmmanager retail branch server 4.34.3.2-150400.3.9.3Not reportedSUSE-SU-2022:3761-1Not reported
Suserelease-notes-susemanagerrpmmanager server 4.34.3.2-150400.3.15.1Not reportedSUSE-SU-2022:3761-1Not reported

[Debian bug #998418]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [node-shell-quote]Unknown
    Details (4)

    • 1.7.4+~1.7.1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.7.3+~1.7.1-1

      dsa · node-shell-quote · debian · bookworm; dsa · node-shell-quote · debian · 12

    • 1.7.4+~1.7.1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.7.3+~1.7.1-1

      dsa · node-shell-quote · debian · bookworm; dsa · node-shell-quote · debian · 12

    • 1.7.4+~1.7.1-1+deb12u1 · all · bookworm-security

      Fixed · Fixed: 1.7.3+~1.7.1-1

      dsa · node-shell-quote · debian · bookworm; dsa · node-shell-quote · debian · 12

    • 1.7.4+~1.7.1-1+deb12u1 · all · bookworm-security

      Fixed · Fixed: 1.7.3+~1.7.1-1

      dsa · node-shell-quote · debian · bookworm; dsa · node-shell-quote · debian · 12

[Debian 13 (Trixie)]

  • [node-shell-quote]Unknown
    Details (5)

    • 1.7.4+~1.7.1-1+deb13u1 · all · trixie

      Fixed · Fixed: 1.7.3+~1.7.1-1

      dsa · node-shell-quote · debian · 13

    • 1.7.4+~1.7.1-1+deb13u1 · all · trixie

      Fixed · Fixed: 1.7.3+~1.7.1-1

      dsa · node-shell-quote · debian · 13

    • 1.7.4+~1.7.1-1+deb13u1 · all · trixie-security

      Fixed · Fixed: 1.7.3+~1.7.1-1

      dsa · node-shell-quote · debian · 13

    • 1.7.4+~1.7.1-1+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 1.7.3+~1.7.1-1

      dsa · node-shell-quote · debian · 13

    • 1.7.4+~1.7.1-1+deb13u2 · all · trixie-security

      Fixed · Fixed: 1.7.3+~1.7.1-1

      dsa · node-shell-quote · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]