Skip to content
OpenAdvisories

Package · npm

shescape

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-73412

    Shescape: Path disclosure on Unix with Zsh

    Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options …

    ericcornelissen shescape shescape npm
  • Medium 6.3
    CVE-2026-73411

    Shescape: Home-directory disclosure in assignment context on Unix with Dash

    Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell…

    ericcornelissen shescape shescape npm
  • Medium 6.9
    CVE-2026-32094

    Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash

    Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-bracket glob syntax for Bash, BusyBox sh, and Dash. Applications that interpolate the return value directly into a shell command string can cau…

    ericcornelissen shescape shescape npm
  • Medium 6.5
    CVE-2023-40185

    Shescape on Windows escaping may be bypassed in threaded context

    shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections…

    ericcornelissen shescape shescape npm
  • Medium 5.3
    CVE-2022-25918

    Regular Expression Denial of Service (ReDoS)

    The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.

    shescape npm
  • Medium 6.2
    CVE-2022-24725

    Exposure of home directory through shescape on Unix with Bash

    Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `interpolation` option…

    ericcornelissen shescape shescape npm
  • Medium 6.3
    CVE-2021-21384

    Null characters not escaped in shescape

    shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an …

    ericcornelissen shescape shescape npm