CVE-2021-21384: Shescape Project Shescape

High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days.

shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.

Affected products

• Shescape Project Shescape: before 1.1.3 (fixed in 1.1.3)

Published 2021-03-19. Last modified 2026-06-17.