{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "shell-quote"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-10541"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:51:49Z",
    "nvd_published_at": "2018-05-31T20:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "Affected versions of `shell-quote` do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments.\n\n\n\n## Proof of Concept:\n\nThe following characters are not escaped properly: `\u003e`,`;`,`{`,`}`\n\nBash has a neat but not well known feature known as \"Bash Brace Expansion\", wherein a sub-command can be executed without spaces by running it between a set of `{}` and using the `,` instead of ` ` to seperate arguments. Because of this, full command injection is possible even though it was initially thought to be impossible. \n\n```\n   const quote = require(\u0027shell-quote\u0027).quote;\n   console.log(quote([\u0027a;{echo,test,123,234}\u0027]));\n   // Actual                    \"a;{echo,test,123,234}\"\n   // Expected                  \"a\\;\\{echo,test,123,234\\}\"\n   // Functional Equivalent     \"a; echo \u0027test\u0027 \u0027123\u0027 \u00271234\u0027\"\n```\n\n\n\n## Recommendation\n\nUpdate to version 1.6.1 or later.",
  "id": "GHSA-qg8p-v9q4-gh34",
  "modified": "2022-11-22T17:49:45Z",
  "published": "2019-02-18T23:58:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10541"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-qg8p-v9q4-gh34"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/117"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Potential Command Injection in shell-quote"
}