Null characters not escaped in shescape
Priority LOW 35CWE-88Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-88.
Summary
shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.
Why it matters now
EPSS 0.00578 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed shescape (ericcornelissen): 1.1.3shescape (npm): 1.1.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ericcornelissen | shescape | before 1.1.3 | 1.1.3 | Patch available | CNA |
| — | shescape (npm) | before 1.1.3 | 1.1.3 | Patch available | GHSA-f2rp-38vg-j3gh |
- shescape Vendorericcornelissen Affected before 1.1.3 Fixed in 1.1.3 Patch available CNA
- shescape (npm) Vendor— Affected before 1.1.3 Fixed in 1.1.3 Patch available GHSA-f2rp-38vg-j3gh
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:shescape_project:shescape:*:*:*:*:*:node.js:*:* | before 1.1.3 | Vulnerable | ericcornelissen |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:opengroup:unix:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Opengroup |
- cpe:2.3:a:shescape_project:shescape:*:*:*:*:*:node.js:*:* Versions before 1.1.3 Vulnerable ·ericcornelissen
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:opengroup:unix:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Opengroup
Remediation
- Fix · CNA shescape (ericcornelissen) Fixed in 1.1.3
- Fix · GHSA-f2rp-38vg-j3gh shescape (npm) Fixed in 1.1.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21384
- 2026-10-03 Alias added: GHSA-f2rp-38vg-j3gh
References
Advisory 2
More ericcornelissen Shescape vulnerabilities
- TI-2022-13220 Insufficient escaping of whitespace in shescape CVSS 3.1CRITICAL 9.8
- TI-2022-13219 Insufficient escaping of line feeds for CMD in shescape CVSS 3.1CRITICAL 9.8
- TI-2022-09469 Regular expression denial of service (ReDoS) in shescape CVSS 3.1HIGH 7.5
- TI-2026-24632 Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash CVSS 4.0MEDIUM 6.9
- TI-2022-16487 Shescape Inefficient Regular Expression Complexity vulnerability CVSS 3.1HIGH 7.5
- TI-2022-08540 Exposure of home directory through shescape on Unix with Bash CVSS 3.1MEDIUM 6.2
Sources
- CVE-2021-21384 · CVE Program
- CVE-2021-21384 · NVD
- FIRST EPSS
- GHSA-f2rp-38vg-j3gh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences