Shescape
Monthly
Command injection in Shescape (npm shell-escaping library) versions below 2.1.14 and the 3.0.x line below 3.0.1 allows an attacker-controlled argument to break out of a parenthesized cmd.exe construct and inject arbitrary shell syntax on Windows. The flaw affects applications that call the escape or escapeAll APIs with shell set to cmd.exe (or shell:true when CMD is the default), because getEscapeFunction in src/internal/win/cmd.js failed to escape the ( and ) characters. A working proof-of-concept payload is published in the vendor advisory; there is no CISA KEV listing and no evidence of active exploitation at time of analysis.
Quadratic-time CPU exhaustion in Shescape's flag-protection loop allows any attacker who can supply untrusted input to the escape, escapeAll, quote, or quoteAll APIs to cause denial of service without authentication or special configuration. Affected npm package versions 2.1.11-2.1.13 and 3.0.0 are vulnerable by default because flagProtection is enabled in the default configuration. The GHSA advisory includes a working proof-of-concept demonstrating approximately 20 seconds of processing time for a 32,000-repeat null-dash payload, and patched releases 2.1.14 and 3.0.1 are available; no active exploitation has been confirmed (not in CISA KEV).
Incomplete Zsh special-character escaping in Shescape allows unauthenticated attackers who control input strings to bypass sanitization and trigger home directory expansion or glob pattern matching, leaking file and directory paths from the host system. Affected are npm/shescape versions below 2.1.14 (v2 branch) and 3.0.0-3.0.0 inclusive (v3 branch) on Unix systems where Zsh is the configured or default shell using the escape or escapeAll methods. No public exploit identified at time of analysis, though the GitHub security advisory GHSA-6v4m-fw66-8r4x includes functional proof-of-concept code; KEV listing is absent.
Incomplete tilde-escaping in Shescape's Dash shell mode allows attacker-controlled input to bypass sanitization and trigger home-directory expansion. Shescape versions prior to 2.1.14 (v2 branch) and 3.0.1 (v3 branch) on Unix systems fail to escape `~` when it follows `:` or `=`, characters that Dash recognizes as tilde-expansion triggers in assignment contexts. An attacker supplying values such as `:~` can disclose the server process's home-directory path and potentially redirect the filesystem location on which the downstream command operates. No public exploit identified at time of analysis, though a functional proof-of-concept is documented in the vendor's security advisory GHSA-q53c-4prm-w95q.
Shescape versions prior to 2.1.10 fail to properly escape square-bracket glob patterns in Bash, BusyBox sh, and Dash, allowing attackers to manipulate shell arguments into multiple filesystem expansions instead of literal strings. Applications using the library's escape() function are vulnerable to argument injection attacks where an attacker-controlled value like "secret[12]" could expand to match multiple files, bypassing intended pathname restrictions. No patch is currently available for affected deployments.
shescape is simple shell escape library for JavaScript. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Shescape is a simple shell escape library for JavaScript. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Shescape is a shell escape package for JavaScript. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Shescape is a simple shell escape package for JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Shescape is a simple shell escape package for JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Shescape is a shell escape package for JavaScript. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
shescape is a simple shell escape package for JavaScript. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Command injection in Shescape (npm shell-escaping library) versions below 2.1.14 and the 3.0.x line below 3.0.1 allows an attacker-controlled argument to break out of a parenthesized cmd.exe construct and inject arbitrary shell syntax on Windows. The flaw affects applications that call the escape or escapeAll APIs with shell set to cmd.exe (or shell:true when CMD is the default), because getEscapeFunction in src/internal/win/cmd.js failed to escape the ( and ) characters. A working proof-of-concept payload is published in the vendor advisory; there is no CISA KEV listing and no evidence of active exploitation at time of analysis.
Quadratic-time CPU exhaustion in Shescape's flag-protection loop allows any attacker who can supply untrusted input to the escape, escapeAll, quote, or quoteAll APIs to cause denial of service without authentication or special configuration. Affected npm package versions 2.1.11-2.1.13 and 3.0.0 are vulnerable by default because flagProtection is enabled in the default configuration. The GHSA advisory includes a working proof-of-concept demonstrating approximately 20 seconds of processing time for a 32,000-repeat null-dash payload, and patched releases 2.1.14 and 3.0.1 are available; no active exploitation has been confirmed (not in CISA KEV).
Incomplete Zsh special-character escaping in Shescape allows unauthenticated attackers who control input strings to bypass sanitization and trigger home directory expansion or glob pattern matching, leaking file and directory paths from the host system. Affected are npm/shescape versions below 2.1.14 (v2 branch) and 3.0.0-3.0.0 inclusive (v3 branch) on Unix systems where Zsh is the configured or default shell using the escape or escapeAll methods. No public exploit identified at time of analysis, though the GitHub security advisory GHSA-6v4m-fw66-8r4x includes functional proof-of-concept code; KEV listing is absent.
Incomplete tilde-escaping in Shescape's Dash shell mode allows attacker-controlled input to bypass sanitization and trigger home-directory expansion. Shescape versions prior to 2.1.14 (v2 branch) and 3.0.1 (v3 branch) on Unix systems fail to escape `~` when it follows `:` or `=`, characters that Dash recognizes as tilde-expansion triggers in assignment contexts. An attacker supplying values such as `:~` can disclose the server process's home-directory path and potentially redirect the filesystem location on which the downstream command operates. No public exploit identified at time of analysis, though a functional proof-of-concept is documented in the vendor's security advisory GHSA-q53c-4prm-w95q.
Shescape versions prior to 2.1.10 fail to properly escape square-bracket glob patterns in Bash, BusyBox sh, and Dash, allowing attackers to manipulate shell arguments into multiple filesystem expansions instead of literal strings. Applications using the library's escape() function are vulnerable to argument injection attacks where an attacker-controlled value like "secret[12]" could expand to match multiple files, bypassing intended pathname restrictions. No patch is currently available for affected deployments.
shescape is simple shell escape library for JavaScript. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Shescape is a simple shell escape library for JavaScript. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Shescape is a shell escape package for JavaScript. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Shescape is a simple shell escape package for JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Shescape is a simple shell escape package for JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Shescape is a shell escape package for JavaScript. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
shescape is a simple shell escape package for JavaScript. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.