CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-31180 – Insufficient escaping of whitespace in shescape
https://notcve.org/view.php?id=CVE-2022-31180
Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. The result is that if an attacker is able to include whitespace in their input they can: 1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace. 2. • https://github.com/ericcornelissen/shescape/pull/322 https://github.com/ericcornelissen/shescape/pull/324 https://github.com/ericcornelissen/shescape/releases/tag/v1.5.7 https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8 https://github.com/ericcornelissen/shescape/security/advisories/GHSA-44vr-rwwj-p88h • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 2CVE-2022-24725 – Exposure of home directory through shescape on Unix with Bash
https://notcve.org/view.php?id=CVE-2022-24725
Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `interpolation` option set to `true`. Other tested shells, Dash and Zsh, are not affected. Depending on how the output of _shescape_ is used, directory traversal may be possible in the application using _shescape_. The issue was patched in version 1.5.1. • https://github.com/ericcornelissen/shescape/issues/169 https://github.com/ericcornelissen/shescape/pull/170 https://github.com/ericcornelissen/shescape/security/advisories/GHSA-446w-rrm4-r47f • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-21384 – Null characters not escaped in shescape
https://notcve.org/view.php?id=CVE-2021-21384
shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required. shescape es un paquete de escape de shell simple para JavaScript. • https://github.com/ericcornelissen/shescape/commit/07a069a66423809cbedd61d980c11ca44a29ea2b https://github.com/ericcornelissen/shescape/releases/tag/v1.1.3 https://github.com/ericcornelissen/shescape/security/advisories/GHSA-f2rp-38vg-j3gh https://www.npmjs.com/package/shescape • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •