Skip to content
OpenAdvisories

Vendor

ericcornelissen

15 known vulnerabilities.

Products

shescape 14 git-tag-annotation-action 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.7
    CVE-2026-73413

    Shescape: Quadratic-time denial of service in flag-protection

    Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, makin…

    ericcornelissen shescape shescape npm
  • High 8.1
    CVE-2022-31179

    Insufficient escaping of line feeds for CMD in shescape

    Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows An attacker can omit al…

    ericcornelissen shescape shescape npm
  • High 8.7
    CVE-2020-15272

    Shell-injection in git-tag-annotation GitHub action

    In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if they can control the value of [the `tag` input] or manage to alter the value of [the `GITHUB_REF` environment variable].…

    ericcornelissen git-tag-annotation-action