Path to dependency file: /Gmright/Milestones/Gmright-market/cordova-plugin-purchase-master/cordova-plugin-purchase-master/package.json
Path to vulnerable library: /Gmright/Milestones/Gmright-market/cordova-plugin-purchase-master/cordova-plugin-purchase-master/node_modules/shell-quote/package.json,/Gmright/Milestones/Gmright-market/cordova-plugin-purchase-master/cordova-plugin-purchase-master/node_modules/shell-quote/package.json
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
CVE-2021-42740 - Critical Severity Vulnerability
quote and parse shell commands
Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.6.1.tgz
Path to dependency file: /Gmright/Milestones/Gmright-market/cordova-plugin-purchase-master/cordova-plugin-purchase-master/package.json
Path to vulnerable library: /Gmright/Milestones/Gmright-market/cordova-plugin-purchase-master/cordova-plugin-purchase-master/node_modules/shell-quote/package.json,/Gmright/Milestones/Gmright-market/cordova-plugin-purchase-master/cordova-plugin-purchase-master/node_modules/shell-quote/package.json
Dependency Hierarchy: - cordova-6.5.0.tgz (Root Library) - cordova-lib-6.5.0.tgz - cordova-js-4.2.1.tgz - browserify-13.3.0.tgz - :x: **shell-quote-1.6.1.tgz** (Vulnerable Library)
Found in HEAD commit: b7c024e8a4ee13f6a45cb00117437f5302af545e
Found in base branch: master
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Publish Date: 2021-10-21
URL: CVE-2021-42740
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740
Release Date: 2021-10-21
Fix Resolution (shell-quote): 1.7.3
Direct dependency fix Resolution (cordova): 6.5.1-nightly.2017.2.15.abe6b8f1
Step up your Open Source Security Game with Mend here