OS Command Injection In node-shell-quote
Description
A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 14 | 1.8.4+~1.7.5-1 | ||
 rpm rhel8 | - | - | |
rpm rhel9 | - | - | |
debian 12 | 1.7.4+~1.7.1-1+deb12u1 | ||
debian 13 | 1.7.4+~1.7.1-1+deb13u1 |
Aliases
1. 2. 3. 4. 5.