CVE-2021-21384 — Null characters not escaped in shescape
shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable aga…
Published: 2021-03-18 · CVSS: 6.3 · CVSS 3.1
shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7