CVE-2021-21384
Medium
Description
shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.
SeverityMedium
CVSS6.3
Exploit probability—
ProductShescape
PublishedMar 19, 2021
First seenMar 19, 2021
Weakness typeCWE-88CWE-88
How to fix
Update
- shescape_project shescape1.1.3 or later
- shescape1.1.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| shescape_project shescape | v < 1.1.3 | 1.1.3 |
| shescapenpm | v < 1.1.3 | 1.1.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.