cve/2016/CVE-2016-10541.md

### [CVE-2016-10541](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10541)
![](https://img.shields.io/static/v1?label=Product&message=shell-quote%20node%20module&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=OS%20Command%20Injection%20(CWE-78)&color=brighgreen)

### Description

The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.

### POC

#### Reference
- https://github.com/advisories/GHSA-qg8p-v9q4-gh34
- https://github.com/advisories/GHSA-qg8p-v9q4-gh34

#### Github
- https://github.com/ARPSyndicate/cvemon