CVE-2021-21384 Null characters not escaped in shescape

What is CVE-2021-21384?

CVE-2021-21384 is a medium-severity command injection vulnerability in ericcornelissen shescape, published on 18 Mar 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.

Weakness: CWE-88

Which versions are affected by CVE-2021-21384?

2 open source packages ship an affected version, including shescape. It affects 1 product.

Products include Shescape Project Shescape.

How do I fix CVE-2021-21384?

Upgrade shescape to 1.1.3 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2021-21384 being exploited?

There is no known exploitation of CVE-2021-21384 in the wild and no public exploit code.

Other vulnerabilities in ericcornelissen shescape

• CVE-2022-31180 Insufficient escaping of whitespace in shescape Critical 9.8
• CVE-2022-31179 Insufficient escaping of line feeds for CMD in shescape High 8.1
• CVE-2026-32094 Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash Medium 6.9
• CVE-2023-40185 Shescape on Windows escaping may be bypassed in threaded context Medium 6.5
• CVE-2022-24725 Exposure of home directory through shescape on Unix with Bash Medium 6.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f2rp-38vg-j3gh.