CVSS: 8.6EPSS: 0%CPEs: 2EXPL: 1CVE-2023-40185 – Shescape on Windows escaping may be bypassed in threaded context
https://notcve.org/view.php?id=CVE-2023-40185
shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell. This bug has been patched in version 1.7.4. • https://github.com/ericcornelissen/shescape/commit/0b976dab645abf45ffd85e74a8c6e51ee2f42d63 https://github.com/ericcornelissen/shescape/pull/1142 https://github.com/ericcornelissen/shescape/releases/tag/v1.7.4 https://github.com/ericcornelissen/shescape/security/advisories/GHSA-j55r-787p-m549 • CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-35931 – Shescape potential environment variable exposure on Windows with CMD
https://notcve.org/view.php?id=CVE-2023-35931
Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1. • https://github.com/ericcornelissen/shescape/commit/d0fce70f987ac0d8331f93cb45d47e79436173ac https://github.com/ericcornelissen/shescape/pull/982 https://github.com/ericcornelissen/shescape/releases/tag/v1.7.1 https://github.com/ericcornelissen/shescape/security/advisories/GHSA-3g7p-8qhx-mc8r • CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-36064 – Shescape Inefficient Regular Expression Complexity vulnerability
https://notcve.org/view.php?id=CVE-2022-36064
Shescape is a shell escape package for JavaScript. An Inefficient Regular Expression Complexity vulnerability impacts users that use Shescape to escape arguments for the Unix shells `Bash` and `Dash`, or any not-officially-supported Unix shell; and/or using the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. An attacker can cause polynomial backtracking or quadratic runtime in terms of the input string length due to two Regular Expressions in Shescape that are vulnerable to Regular Expression Denial of Service (ReDoS). This bug has been patched in v1.5.10. For `Dash` only, this bug has been patched since v1.5.9. • https://github.com/ericcornelissen/shescape/pull/373 https://github.com/ericcornelissen/shescape/releases/tag/v1.5.10 https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gp75-h7j6-5pv3 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-31179 – Insufficient escaping of line feeds for CMD in shescape
https://notcve.org/view.php?id=CVE-2022-31179
Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows An attacker can omit all arguments following their input by including a line feed character (`'\n'`) in the payload. This bug has been patched in [v1.5.8] which you can upgrade to now. No further changes are required. • https://github.com/ericcornelissen/shescape/pull/332 https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8 https://github.com/ericcornelissen/shescape/security/advisories/GHSA-jjc5-fp7p-6f8w • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-31180 – Insufficient escaping of whitespace in shescape
https://notcve.org/view.php?id=CVE-2022-31180
Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. The result is that if an attacker is able to include whitespace in their input they can: 1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace. 2. • https://github.com/ericcornelissen/shescape/pull/322 https://github.com/ericcornelissen/shescape/pull/324 https://github.com/ericcornelissen/shescape/releases/tag/v1.5.7 https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8 https://github.com/ericcornelissen/shescape/security/advisories/GHSA-44vr-rwwj-p88h • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •