Skip to main content

Shescape CVE-2026-73413

| EUVDEUVD-2026-57527 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-08-12 GitHub_M GHSA-gm3r-q2wp-hw87
Denial Of Service Shescape
8.7
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable via default configuration with no authentication (PR:N); sole impact is high availability loss from CPU exhaustion with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 12, 2026 - 21:17 EUVD
Source Code Evidence Fetched
Aug 12, 2026 - 20:39 vuln.today
Analysis Generated
Aug 12, 2026 - 20:39 vuln.today
CVE Published
Aug 12, 2026 - 19:40 cve.org
HIGH 8.7

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 npm packages depend on shescape (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.1.11.

DescriptionCVE.org

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1.

AnalysisAI

Quadratic-time CPU exhaustion in Shescape's flag-protection loop allows any attacker who can supply untrusted input to the escape, escapeAll, quote, or quoteAll APIs to cause denial of service without authentication or special configuration. Affected npm package versions 2.1.11-2.1.13 and 3.0.0 are vulnerable by default because flagProtection is enabled in the default configuration. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Submit oversized crafted payload
Delivery
Reach application endpoint invoking Shescape API
Exploit
Default flagProtection processes null-dash fragments
Execution
Quadratic join loop exhausts CPU cycles
Persist
Server becomes unresponsive
Impact
Deny service to legitimate users
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that attacker-controlled input reaches any of Shescape's four public APIs - escape, escapeAll, quote, or quoteAll - without a prior length restriction. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) scores 8.7, reflecting network-accessible exploitation with no authentication, no attack prerequisites, and high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker submits an HTTP request body containing a string of 32,000 `\u0000-` repetitions to a web application that passes unbounded user input through Shescape's default-configured escape or quote API. Shescape's quadratic flag-protection loop spends approximately 20 seconds processing the payload, as confirmed by the public PoC in GHSA-gm3r-q2wp-hw87. …
Remediation Upgrade to shescape v2.1.14 or v3.0.1, both confirmed available as tagged releases at https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14 and https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1 respectively. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, scan production and development environments to identify all applications and services using Shescape versions 2.1.11-2.1.13 or 3.0.0, including transitive dependencies through build systems and package managers. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Shescape

View all
CVE-2022-31180 CRITICAL POC
9.8 Aug 01

Shescape is a simple shell escape package for JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remo
CVE-2022-31179 CRITICAL POC
9.8 Aug 01

Shescape is a simple shell escape package for JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remo
CVE-2023-40185 HIGH POC
8.6 Aug 23

shescape is simple shell escape library for JavaScript. Rated high severity (CVSS 8.6), this vulnerability is remotely e
CVE-2021-21384 HIGH POC
7.8 Mar 19

shescape is a simple shell escape package for JavaScript. Rated high severity (CVSS 7.8), this vulnerability is low atta
CVE-2022-25918 HIGH POC
7.5 Oct 27

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the
CVE-2022-36064 HIGH POC
7.5 Sep 06

Shescape is a shell escape package for JavaScript. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi
CVE-2022-24725 MEDIUM POC
5.5 Mar 03

Shescape is a shell escape package for JavaScript. Rated medium severity (CVSS 5.5), this vulnerability is low attack co
CVE-2026-73414 CRITICAL
9.2 Aug 12

Command injection in Shescape (npm shell-escaping library) versions below 2.1.14 and the 3.0.x line below 3.0.1 allows a
CVE-2023-35931 MEDIUM POC
4.3 Jun 23

Shescape is a simple shell escape library for JavaScript. Rated medium severity (CVSS 4.3), this vulnerability is remote
CVE-2026-32094 MEDIUM
6.5 Mar 11

Shescape versions prior to 2.1.10 fail to properly escape square-bracket glob patterns in Bash, BusyBox sh, and Dash, al
CVE-2026-73412 MEDIUM
6.3 Aug 12

Incomplete Zsh special-character escaping in Shescape allows unauthenticated attackers who control input strings to bypa
CVE-2026-73411 MEDIUM
6.3 Aug 12

Incomplete tilde-escaping in Shescape's Dash shell mode allows attacker-controlled input to bypass sanitization and trig

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-73413 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy