CVE-2021-21384 - CVE House

Back to Database

Status published Medium CVE-2021-21384

Null characters not escaped in shescape

6.3 CVSS

Vulnerability Description

shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-21384

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from ericcornelissen

View All →

Shescape has potential environment variable exposure on Windows with CMD

Shescape on Windows escaping may be bypassed in threaded context

Shescape potential environment variable exposure on Windows with CMD

Shescape Inefficient Regular Expression Complexity vulnerability

Insufficient escaping of whitespace in shescape

Affected Vendor

ericcornelissen

View all reports →

Affected Software

shescape

Vulnerable Versions:

< 1.1.3

Timeline

Official Publish: March 18th, 2021

Last Modified: August 3rd, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation