Executive brief
shell-quote is a JavaScript library used to safely escape command-line arguments for shell execution. The library fails to properly escape special characters (semicolons, braces, and other shell metacharacters), allowing attackers to inject arbitrary shell commands. An application using shell-quote to sanitize untrusted input for shell commands could be tricked into executing attacker-controlled code, leading to complete system compromise.
Technical details
shell-quote is a Node.js library designed to escape arguments for safe shell command execution. The vulnerability is an OS command injection (CWE-78) caused by improper neutralization of shell metacharacters—specifically semicolons, curly braces, and other special characters used in bash brace expansion. An attacker can craft input like 'a;{echo,test,123,234}' which, when passed to shell-quote().quote(), is not properly escaped, allowing the injection of arbitrary commands executed via bash brace expansion syntax. The attack requires no authentication or user interaction; any application using shell-quote to escape untrusted input destined for shell execution is vulnerable. Affected versions are all releases prior to 1.6.1, which introduced proper escaping for these characters.
Affected products
- shell-quote shell-quote < 1.6.1
Timeline
- 2018-05-31: disclosed
- 2019-02-18: advisory
- 2019-02-18: patched: Version 1.6.1 released with proper character escaping