fix: Improper neutralization of special elements used in a command in shell-quote-twitter

Browse Source

## 👾 Describe The Sumarry:
The shell-quote used on your project before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character. Affected of this project are vulnerable to Remote Code Execution (RCE). An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.





## 🥷 According CVeScores:
CVE-2021-42740
[CWE-77](https://cwe.mitre.org/data/definitions/77.html)
`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

...

This commit is contained in:

hackersontwohouse 2024-05-17 13:41:54 +07:00 committed by GitHub

parent d94f4cf793

commit afa6fbceee

No known key found for this signature in database

GPG Key ID: B5690EEEBB952194

1 changed files with 161 additions and 194 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Show Stats Download Patch File Download Diff File Expand all files Collapse all files

355

yarn.lock

View File

File diff suppressed because it is too large Load Diff