Shescape
CVE-2023-35931
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1.
AnalysisAI
Shescape is a simple shell escape library for JavaScript. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Technical ContextAI
This vulnerability is classified under CWE-526. Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1. Affected products include: Shescape Project Shescape. Version information: version 1.7.1..
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Shescape is a simple shell escape package for JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remo
Shescape is a simple shell escape package for JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remo
shescape is simple shell escape library for JavaScript. Rated high severity (CVSS 8.6), this vulnerability is remotely e
shescape is a simple shell escape package for JavaScript. Rated high severity (CVSS 7.8), this vulnerability is low atta
The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the
Shescape is a shell escape package for JavaScript. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi
Shescape is a shell escape package for JavaScript. Rated medium severity (CVSS 5.5), this vulnerability is low attack co
Command injection in Shescape (npm shell-escaping library) versions below 2.1.14 and the 3.0.x line below 3.0.1 allows a
Quadratic-time CPU exhaustion in Shescape's flag-protection loop allows any attacker who can supply untrusted input to t
Shescape versions prior to 2.1.10 fail to properly escape square-bracket glob patterns in Bash, BusyBox sh, and Dash, al
Incomplete Zsh special-character escaping in Shescape allows unauthenticated attackers who control input strings to bypa
Incomplete tilde-escaping in Shescape's Dash shell mode allows attacker-controlled input to bypass sanitization and trig
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today