Shescape CVE-2026-73413

Exploitation requires that attacker-controlled input reaches any of Shescape's four public APIs - escape, escapeAll, quote, or quoteAll - without a prior length restriction. Flag protection must be active, but this is the library default (flagProtection unspecified or explicitly true), so no non-default configuration is needed. The attacker must be able to supply input long enough to trigger meaningful quadratic slowdown; the PoC uses 32,000 repetitions (~64,000 characters). Exploitation is limited by any upstream input validation in the consuming application that bounds string length before calling Shescape. Whether the vulnerable API endpoint requires application-level authentication depends entirely on the application, not on Shescape itself - the library imposes no authentication of its own.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) scores 8.7, reflecting network-accessible exploitation with no authentication, no attack prerequisites, and high availability impact. There is no confidentiality or integrity effect. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. KEV status is negative - no confirmed active exploitation by CISA. However, the GHSA advisory includes a fully functional, copy-paste-ready PoC with exact payload and measured impact, making exploitation trivial for any attacker who can reach an application endpoint that forwards untrusted input to Shescape. Since flag protection is the default, the exposure is as wide as the library's deployment footprint - no misconfiguration is required. The primary real-world limiting factor is that an attacker must be able to supply unbounded input to a Shescape API call; applications enforcing input length limits before calling the library would not be exposed.

An attacker submits an HTTP request body containing a string of 32,000 \u0000- repetitions to a web application that passes unbounded user input through Shescape's default-configured escape or quote API. Shescape's quadratic flag-protection loop spends approximately 20 seconds processing the payload, as confirmed by the public PoC in GHSA-gm3r-q2wp-hw87. Repeating this request at modest frequency saturates server CPU, causing denial of service for legitimate users with no authentication or elevated privilege required.