# CVE-2021-21384: Shescape null character escape bypass in shell quoting

Source: https://junglewise.ai/threats/cve-2021-21384-shescape-null-character-escape-bypass-in-shell-quoting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-03-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-21384 · Severity: low · CVSS 3.1 · Published 2021-03-18

Shescape is a JavaScript library used to defend applications against shell injection attacks by safely escaping user input. A flaw in the library fails to escape null characters, allowing attackers to bypass its protection mechanism and execute arbitrary shell commands if they can inject null bytes into input.

Technologies: [shescape (npm)](https://junglewise.ai/threats/technologies/shescape). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-21384 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-21384 being exploited in the wild.

**How severe is CVE-2021-21384?** Low severity, with a CVSS score of 3.1, published 18 March 2021.

**Which products and versions are affected?** shescape (npm) SEMVER:introduced=0,fixed=1.1.3.

**Is there a fix for CVE-2021-21384?** Yes. shescape (npm): upgrade to 1.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-21384 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2021-21384?** Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- shescape (npm): upgrade to 1.1.3 or later

  ```sh
  npm install shescape@1.1.3
  ```


## Technical details

The vulnerability is an incomplete input sanitization flaw in Shescape's quote() function (CWE-88). The library failed to escape null characters (\x00) in shell command arguments, allowing them to pass through to the shell unfiltered. An attacker who can control user input can inject a null byte followed by arbitrary shell commands. The vulnerability affects all versions prior to 1.1.3, is network-reachable if the application processes untrusted input, and allows command execution depending on application context and shell behavior. The patch in v1.1.3 properly escapes null characters.

## Affected products

- Eric Cornelissen Shescape < 1.1.3

## Identifiers

- CVE-2021-21384
- GHSA-f2rp-38vg-j3gh

## Timeline

- 2021-03-13: disclosed
- 2021-03-18: patched: v1.1.3 released

## References

- [https://github.com/ericcornelissen/shescape/security/advisories/GHSA-f2rp-38vg-j3gh](https://github.com/ericcornelissen/shescape/security/advisories/GHSA-f2rp-38vg-j3gh)

## Related threats

- [Shescape shell injection via unescaped parentheses on Windows CMD](https://junglewise.ai/threats/cve-2026-73414-shescape-shell-injection-via-unescaped-parentheses-on-windows-cmd)
- [Shescape quadratic-time denial of service in flag-protection](https://junglewise.ai/threats/cve-2026-73413-shescape-quadratic-time-denial-of-service-in-flag-protection)
- [Shescape path disclosure on Unix with Zsh](https://junglewise.ai/threats/cve-2026-73412-shescape-path-disclosure-on-unix-with-zsh)
- [Shescape home-directory disclosure in Dash shell assignment](https://junglewise.ai/threats/cve-2026-73411-shescape-home-directory-disclosure-in-dash-shell-assignment)
- [Shescape escape() bracket glob expansion bypass on Bash, BusyBox, and Dash](https://junglewise.ai/threats/cve-2026-32094-shescape-escape-bracket-glob-expansion-bypass-on-bash-busybox-and)