{"action":"Upgrade node-shell-quote to 1.7.3+~1.7.1-1 or later.","affected":[{"fixed":"1.7.3+~1.7.1-1","introduced":"0"}],"component":"node-shell-quote","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["1.7.3+~1.7.1-1"],"id":"tcs_01M5NG14J7ZBSQRF9ENEZC3EB2","modified_at":"2026-10-23T18:04:39.147890730Z","published_at":"2021-10-21T15:15:07.633Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2021-42740","https://security-tracker.debian.org/tracker/CVE-2021-42740"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2021-42740#Debian:13/node-shell-quote","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2021-42740"}],"summary":"The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the outpu"}