https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:16:36 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-183624 EUVD-2026-183624 https://cve.radiocsirt.org/vuln/euvd-2026-183624 https://cve.radiocsirt.org/vuln/fkie_cve-2016-10541 <p>The npm module &#34;shell-quote&#34; 1.6.0 and earlier cannot correctly escape &#34;&gt;&#34; and &#34;&lt;&#34; operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.</p> <p>The npm module &#34;shell-quote&#34; 1.6.0 and earlier cannot correctly escape &#34;&gt;&#34; and &#34;&lt;&#34; operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2016-10541 https://cve.radiocsirt.org/vuln/ghsa-qg8p-v9q4-gh34 <p><strong>Affected:</strong> npm: shell-quote</p> <p>Affected versions of `shell-quote` do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments.</p> <p>## Proof of Concept:</p> <p>The following characters are not escaped properly: `&gt;`,`;`,`{`,`}`</p> <p>Bash has a neat but not well known feature known as &#34;Bash Brace Expansion&#34;, wherein a sub-command can be executed without spaces by running it between a set of `{}` and using the `,` instead of ` ` to seperate arguments. Because of this, full command injection is possible even though it was initially thought to be impossible.</p> <p>``` const quote = require(&#39;shell-quote&#39;).quote; console.log(quote([&#39;a;{echo,test,123,234}&#39;])); // Actual &#34;a;{echo,test,123,234}&#34; // Expected &#34;a\;\{echo,test,123,234\}&#34; // Functional Equivalent &#34;a; echo &#39;test&#39; &#39;123&#39; &#39;1234&#39;&#34; ```</p> <p>## Recommendation</p> <p>Update to version 1.6.1 or later.</p> <p><strong>Affected:</strong> npm: shell-quote</p> <p>Affected versions of `shell-quote` do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments.</p> <p>## Proof of Concept:</p> <p>The following characters are not escaped properly: `&gt;`,`;`,`{`,`}`</p> <p>Bash has a neat but not well known feature known as &#34;Bash Brace Expansion&#34;, wherein a sub-command can be executed without spaces by running it between a set of `{}` and using the `,` instead of ` ` to seperate arguments. Because of this, full command injection is possible even though it was initially thought to be impossible.</p> <p>``` const quote = require(&#39;shell-quote&#39;).quote; console.log(quote([&#39;a;{echo,test,123,234}&#39;])); // Actual &#34;a;{echo,test,123,234}&#34; // Expected &#34;a\;\{echo,test,123,234\}&#34; // Functional Equivalent &#34;a; echo &#39;test&#39; &#39;123&#39; &#39;1234&#39;&#34; ```</p> <p>## Recommendation</p> <p>Update to version 1.6.1 or later.</p> https://cve.radiocsirt.org/vuln/ghsa-qg8p-v9q4-gh34 https://cve.radiocsirt.org/vuln/gsd-2016-10541 gsd-2016-10541 https://cve.radiocsirt.org/vuln/gsd-2016-10541