CVE-2021-21384

Description

shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.

Weakness classification

• security-advisories@github.com: CWE-88

Primary references

• security-advisories@github.com — Patch, Third Party Advisory
• security-advisories@github.com — Release Notes, Third Party Advisory
• security-advisories@github.com — Exploit, Third Party Advisory
• security-advisories@github.com — Product
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Product