Ericcornelissen
Monthly
Command injection in Shescape (npm shell-escaping library) versions below 2.1.14 and the 3.0.x line below 3.0.1 allows an attacker-controlled argument to break out of a parenthesized cmd.exe construct and inject arbitrary shell syntax on Windows. The flaw affects applications that call the escape or escapeAll APIs with shell set to cmd.exe (or shell:true when CMD is the default), because getEscapeFunction in src/internal/win/cmd.js failed to escape the ( and ) characters. A working proof-of-concept payload is published in the vendor advisory; there is no CISA KEV listing and no evidence of active exploitation at time of analysis.
Quadratic-time CPU exhaustion in Shescape's flag-protection loop allows any attacker who can supply untrusted input to the escape, escapeAll, quote, or quoteAll APIs to cause denial of service without authentication or special configuration. Affected npm package versions 2.1.11-2.1.13 and 3.0.0 are vulnerable by default because flagProtection is enabled in the default configuration. The GHSA advisory includes a working proof-of-concept demonstrating approximately 20 seconds of processing time for a 32,000-repeat null-dash payload, and patched releases 2.1.14 and 3.0.1 are available; no active exploitation has been confirmed (not in CISA KEV).
Incomplete Zsh special-character escaping in Shescape allows unauthenticated attackers who control input strings to bypass sanitization and trigger home directory expansion or glob pattern matching, leaking file and directory paths from the host system. Affected are npm/shescape versions below 2.1.14 (v2 branch) and 3.0.0-3.0.0 inclusive (v3 branch) on Unix systems where Zsh is the configured or default shell using the escape or escapeAll methods. No public exploit identified at time of analysis, though the GitHub security advisory GHSA-6v4m-fw66-8r4x includes functional proof-of-concept code; KEV listing is absent.
Incomplete tilde-escaping in Shescape's Dash shell mode allows attacker-controlled input to bypass sanitization and trigger home-directory expansion. Shescape versions prior to 2.1.14 (v2 branch) and 3.0.1 (v3 branch) on Unix systems fail to escape `~` when it follows `:` or `=`, characters that Dash recognizes as tilde-expansion triggers in assignment contexts. An attacker supplying values such as `:~` can disclose the server process's home-directory path and potentially redirect the filesystem location on which the downstream command operates. No public exploit identified at time of analysis, though a functional proof-of-concept is documented in the vendor's security advisory GHSA-q53c-4prm-w95q.
Command injection in Shescape (npm shell-escaping library) versions below 2.1.14 and the 3.0.x line below 3.0.1 allows an attacker-controlled argument to break out of a parenthesized cmd.exe construct and inject arbitrary shell syntax on Windows. The flaw affects applications that call the escape or escapeAll APIs with shell set to cmd.exe (or shell:true when CMD is the default), because getEscapeFunction in src/internal/win/cmd.js failed to escape the ( and ) characters. A working proof-of-concept payload is published in the vendor advisory; there is no CISA KEV listing and no evidence of active exploitation at time of analysis.
Quadratic-time CPU exhaustion in Shescape's flag-protection loop allows any attacker who can supply untrusted input to the escape, escapeAll, quote, or quoteAll APIs to cause denial of service without authentication or special configuration. Affected npm package versions 2.1.11-2.1.13 and 3.0.0 are vulnerable by default because flagProtection is enabled in the default configuration. The GHSA advisory includes a working proof-of-concept demonstrating approximately 20 seconds of processing time for a 32,000-repeat null-dash payload, and patched releases 2.1.14 and 3.0.1 are available; no active exploitation has been confirmed (not in CISA KEV).
Incomplete Zsh special-character escaping in Shescape allows unauthenticated attackers who control input strings to bypass sanitization and trigger home directory expansion or glob pattern matching, leaking file and directory paths from the host system. Affected are npm/shescape versions below 2.1.14 (v2 branch) and 3.0.0-3.0.0 inclusive (v3 branch) on Unix systems where Zsh is the configured or default shell using the escape or escapeAll methods. No public exploit identified at time of analysis, though the GitHub security advisory GHSA-6v4m-fw66-8r4x includes functional proof-of-concept code; KEV listing is absent.
Incomplete tilde-escaping in Shescape's Dash shell mode allows attacker-controlled input to bypass sanitization and trigger home-directory expansion. Shescape versions prior to 2.1.14 (v2 branch) and 3.0.1 (v3 branch) on Unix systems fail to escape `~` when it follows `:` or `=`, characters that Dash recognizes as tilde-expansion triggers in assignment contexts. An attacker supplying values such as `:~` can disclose the server process's home-directory path and potentially redirect the filesystem location on which the downstream command operates. No public exploit identified at time of analysis, though a functional proof-of-concept is documented in the vendor's security advisory GHSA-q53c-4prm-w95q.