Skip to content
OpenAdvisories

Package · npm

shescape

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.7
    CVE-2026-73413

    Shescape: Quadratic-time denial of service in flag-protection

    Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, makin…

    ericcornelissen shescape shescape npm
  • High 8.1
    CVE-2022-31179

    Insufficient escaping of line feeds for CMD in shescape

    Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows An attacker can omit al…

    ericcornelissen shescape shescape npm