https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:42:47 +0000 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0276 certfr-2023-avi-0276 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0276 https://cve.radiocsirt.org/vuln/euvd-2026-32201 EUVD-2026-32201 https://cve.radiocsirt.org/vuln/euvd-2026-32201 https://cve.radiocsirt.org/vuln/fkie_cve-2021-42740 <p>The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.</p> <p>The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-42740 https://cve.radiocsirt.org/vuln/ghsa-g4rg-993r-mgx7 <p><strong>Affected:</strong> npm: shell-quote</p> <p>The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with `exec()`, an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is `[A-z]` instead of the correct `[A-Za-z]`. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.</p> <p><strong>Affected:</strong> npm: shell-quote</p> <p>The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with `exec()`, an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is `[A-z]` instead of the correct `[A-Za-z]`. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.</p> https://cve.radiocsirt.org/vuln/ghsa-g4rg-993r-mgx7 https://cve.radiocsirt.org/vuln/gsd-2021-42740 gsd-2021-42740 https://cve.radiocsirt.org/vuln/gsd-2021-42740 https://cve.radiocsirt.org/vuln/suse-su-2022:3313-1 <p>Security update for release-notes-susemanager, release-notes-susemanager-proxy</p> <p>Security update for release-notes-susemanager, release-notes-susemanager-proxy</p> https://cve.radiocsirt.org/vuln/suse-su-2022:3313-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-42740 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: node-shell-quote</p> <p>The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: node-shell-quote</p> <p>The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-42740 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1476 <p>Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in SUSE Manager ausnutzen, um Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuführen, seine Privilegien zu erweitern und einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in SUSE Manager ausnutzen, um Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuführen, seine Privilegien zu erweitern und einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1476