CVE-2021-42740

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

• CWE-77

• https://github.com/substack/node-shell-quote/blob/master/CHANGELOG.md#173Third Party Advisory
• https://github.com/substack/node-shell-quote/commit/5799416ed454aa4ec9afafc895b4e31760ea1abePatch, Third Party Advisory
• https://www.npmjs.com/package/shell-quoteVendor Advisory
• https://github.com/substack/node-shell-quote/blob/master/CHANGELOG.md#173Third Party Advisory
• https://github.com/substack/node-shell-quote/commit/5799416ed454aa4ec9afafc895b4e31760ea1abePatch, Third Party Advisory
• https://www.npmjs.com/package/shell-quoteVendor Advisory

Published

Oct 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42734Adobe Photoshop version 22.5.1  and earlier versions   are a…5.5
• CVE-2021-42735Adobe Photoshop version 22.5.1 (and earlier versions ) is af…7.8
• CVE-2021-42737Adobe Prelude version 10.1 (and earlier) is affected by a me…7.8
• CVE-2021-42738Adobe Prelude version 10.1 (and earlier) is affected by a me…7.8
• CVE-2021-42739The firewire subsystem in the Linux kernel through 5.14.13 h…6.7
• CVE-2021-4274A vulnerability, which was classified as problematic, has be…6.1
• CVE-2021-42743A misconfiguration in the node default path allows for local…7.8
• CVE-2021-42744Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does n…5.5
• CVE-2021-42748In Beaver Builder through 2.5.0.3, attackers can bypass the …5.3
• CVE-2021-42749In Beaver Themer, attackers can bypass conditional logic con…5.3
• CVE-2021-4275A vulnerability, which was classified as problematic, was fo…8.8
• CVE-2021-42750A cross-site scripting (XSS) vulnerability in Rule Engine in…4.8