shescape
npm8 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting shescapepage 1 of 1
- CVE-2021-21384MEDIUMCVSS 6.3EG 6.3✓ Fixed in 1.1.32021-03-19
shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into …
- CVE-2022-24725MEDIUMCVSS 6.2EG 6.2✓ Fixed in 1.5.12022-03-03
Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `i…
- CVE-2022-25918MEDIUMCVSS 5.3EG 5.3✓ Fixed in 1.6.12022-10-27
The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.
- CVE-2022-31179HIGHCVSS 8.1EG 8.1✓ Fixed in 1.5.82022-08-01
Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows An …
- CVE-2022-31180CRITICALCVSS 9.8EG 9.8✓ Fixed in 1.5.82022-08-01
Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the `escape` or `escapeAll` functions wit…
- CVE-2023-35931LOWCVSS 3.1EG 3.1✓ Fixed in 1.7.12023-06-23
Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1.
- CVE-2023-40185MEDIUMCVSS 6.5EG 6.5✓ Fixed in 1.7.42023-08-23
shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers t…
- CVE-2025-30222NONECVSS 0.0EG 0.0✓ Fixed in 2.1.22025-03-25
Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure `shell…
Check whether shescape is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for shescape CVEs against the assets you own.
Start Free Scan →