EUVD-2026-57525
GHSA-6v4m-fw66-8r4x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N because attacker-controlled input arrives over the network; AC:H because Zsh must be the configured shell, a deliberate non-default condition; C:L for limited file path disclosure with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used to leak more information. This issue is fixed in versions 2.1.14 and 3.0.1.
AnalysisAI
Incomplete Zsh special-character escaping in Shescape allows unauthenticated attackers who control input strings to bypass sanitization and trigger home directory expansion or glob pattern matching, leaking file and directory paths from the host system. Affected are npm/shescape versions below 2.1.14 (v2 branch) and 3.0.0-3.0.0 inclusive (v3 branch) on Unix systems where Zsh is the configured or default shell using the escape or escapeAll methods. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the Node.js application must use Shescape with the shell option set explicitly to 'zsh' or to boolean true while the system default shell resolves to Zsh - bash, sh, dash, and other shells are not affected; (2) the application must call escape() or escapeAll() on attacker-controlled input - the quote() and quoteAll() methods are not identified as affected; (3) the application must return or otherwise expose shell command output to the attacker for the disclosure to be useful. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.3 with AT:P (attack requirements present) accurately reflects that exploitation is contingent on a non-default shell configuration, which materially limits real-world exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits the string :~ as a user-controlled argument to a Node.js web application that passes it through shescape.escape() with shell configured to 'zsh'. The unpatched escape function does not escape the tilde in the colon-tilde context, and when the sanitized value is passed to child_process.execSync, Zsh expands ~ to the home directory of the process owner (e.g., /home/appuser), which is reflected in command output returned to the attacker. … |
| Remediation | Upgrade to Shescape v2.1.14 (v2 branch users) or v3.0.1 (v3 branch users); both are confirmed released and available at https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14 and https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1, with fixes landed via pull requests https://github.com/ericcornelissen/shescape/pull/2649 and https://github.com/ericcornelissen/shescape/pull/2651. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Shescape is a simple shell escape package for JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remo
Shescape is a simple shell escape package for JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remo
shescape is simple shell escape library for JavaScript. Rated high severity (CVSS 8.6), this vulnerability is remotely e
shescape is a simple shell escape package for JavaScript. Rated high severity (CVSS 7.8), this vulnerability is low atta
The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the
Shescape is a shell escape package for JavaScript. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi
Shescape is a shell escape package for JavaScript. Rated medium severity (CVSS 5.5), this vulnerability is low attack co
Command injection in Shescape (npm shell-escaping library) versions below 2.1.14 and the 3.0.x line below 3.0.1 allows a
Quadratic-time CPU exhaustion in Shescape's flag-protection loop allows any attacker who can supply untrusted input to t
Shescape is a simple shell escape library for JavaScript. Rated medium severity (CVSS 4.3), this vulnerability is remote
Shescape versions prior to 2.1.10 fail to properly escape square-bracket glob patterns in Bash, BusyBox sh, and Dash, al
Incomplete tilde-escaping in Shescape's Dash shell mode allows attacker-controlled input to bypass sanitization and trig
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today