Description
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-shell-quote | 1.7.3+~1.7.1-1 | — |
| Debian 13 | node-shell-quote | 1.7.3+~1.7.1-1 | — |
| Debian 12 | node-shell-quote | 1.7.3+~1.7.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | node-shell-quote | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server Module 4.2 | cobbler | 3.1.2-150300.5.19.1 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | drools | 7.17.0-150300.4.6.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | grafana-formula | 0.8.1-150300.3.9.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | httpcomponents-asyncclient | 4.1.4-150300.3.3.2 | SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | image-sync-formula | 0.1.1661440526.b08d95b-150300.3.3.2 | SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | inter-server-sync | 0.2.3-150300.8.22.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | mgr-osad | 4.2.9-150300.2.12.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | patterns-suse-manager | 4.2-150300.4.12.2 | SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | prometheus-formula | 0.7.0-150300.3.17.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | py27-compat-salt | 3000.3-150300.7.7.23.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | rhnlib | 4.2.7-150300.4.12.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | salt-netapi-client | 0.20.0-150300.3.9.4 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | saltboot-formula | 0.1.1661440526.b08d95b-150300.3.12.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | smdba | 1.7.11-0.150300.3.12.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | spacecmd | 4.2.19-150300.4.27.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | spacewalk-admin | 4.2.12-150300.3.15.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | spacewalk-backend | 4.2.24-150300.4.29.5 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | spacewalk-certs-tools | 4.2.18-150300.3.24.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | spacewalk-client-tools | 4.2.20-150300.4.24.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | spacewalk-java | 4.2.41-150300.3.43.5 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | spacewalk-search | 4.2.8-150300.3.12.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | spacewalk-web | 4.2.29-150300.3.27.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | subscription-matcher | 0.29-150300.6.12.2 | SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | supportutils-plugin-susemanager | 4.2.5-150300.3.9.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | susemanager | 4.2.37-150300.3.41.1 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | susemanager-build-keys | 15.3.6-150300.3.6.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | susemanager-doc-indexes | 4.2-150300.12.33.4 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | susemanager-docs_en | 4.2-150300.12.33.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | susemanager-schema | 4.2.24-150300.3.27.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | susemanager-sls | 4.2.27-150300.3.33.4 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | uyuni-common-libs | 4.2.7-150300.3.9.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | virtual-host-gatherer | 1.0.24-150300.3.9.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | woodstox | 4.4.2-150300.3.6.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server 4.3 | release-notes-susemanager | 4.3.2-150400.3.15.1 | SUSE-SU-2022:3761-1 |
| SUSE Manager Server 4.2 | release-notes-susemanager | 4.2.9-150300.3.54.1 | SUSE-SU-2022:3313-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Retail Branch Server 4.3 | release-notes-susemanager-proxy | 4.3.2-150400.3.9.3 | SUSE-SU-2022:3761-1 |
| SUSE Manager Retail Branch Server 4.2 | release-notes-susemanager-proxy | 4.2.9-150300.3.43.1 | SUSE-SU-2022:3313-1 |
| SUSE Manager Proxy Module 4.2 | mgr-daemon | 4.2.10-150300.2.9.4 | SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | mgr-osad | 4.2.9-150300.2.12.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | patterns-suse-manager | 4.2-150300.4.12.2 | SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | rhnlib | 4.2.7-150300.4.12.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | spacecmd | 4.2.19-150300.4.27.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-backend | 4.2.24-150300.4.29.5 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-certs-tools | 4.2.18-150300.3.24.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-client-tools | 4.2.20-150300.4.24.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-proxy | 4.2.12-150300.3.21.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-proxy-installer | 4.2.11-150300.3.14.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-web | 4.2.29-150300.3.27.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | susemanager-build-keys | 15.3.6-150300.3.6.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | susemanager-tftpsync-recv | 4.2.5-150300.3.6.2 | SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | uyuni-common-libs | 4.2.7-150300.3.9.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy 4.3 | release-notes-susemanager-proxy | 4.3.2-150400.3.9.3 | SUSE-SU-2022:3761-1 |
| SUSE Manager Proxy 4.2 | release-notes-susemanager-proxy | 4.2.9-150300.3.43.1 | SUSE-SU-2022:3313-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | shell-quote | >= 1.6.3, < 1.7.3 | 1.7.3 | GHSA-g4rg-993r-mgx7 |
Advisories 7
- WID-SEC-2022-1603 IBM Tivoli Netcool/OMNIbus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 24, 2026
- SUSE-SU-2022:3314-1 Security update for SUSE Manager Server 4.2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:0592-1 Security update for SUSE Manager Server 4.2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3313-1 Security update for release-notes-susemanager, release-notes-susemanager-proxy SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3761-1 Security update for release-notes-susemanager, release-notes-susemanager-proxy SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
- WID-SEC-2022-1476 SUSE Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 2, 2023