Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
13 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the API being used. An attacker can cause a runtime quadratic in the input size, causing denial of service for large inputs. Patches This bug has been patched in [v2.1.14] and [v3.0.1] which you can upgrade to now. If you are already using v3 of Shescape, no further changes are required. If you are using v2 of Shescape it is recommended to upgrade as this version reaches end-of-life status on 2026-09-28, follow the [migration guide] to upgrade to v3. No patches will be released for version of Shescape lower than v2.0.0. Workarounds Alternatively, users of Shescape can 1) put restrictions on the length of untrusted input or 2) strip all content before the last - from untrusted inputs. For more information - Comment on Pull Request [#2651] for v2 and [#2649] for v3 - Comment on commit [b4b34c3] for v2 and [43d70b5] for v3 - Open an issue at…
Recommended action: Upgrade to 3.0.1 or 2.1.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This impacts users of Shescape on Unix systems that explicitly configure shell to Dash, or true when the default shell is Dash, using the escape and escapeAll APIs in assignments prefixed to a command. An attacker may be able to obtain the location of the home directory and, depending on how it is used, change the location on which a command operates in unexpected ways. Patches This bug has been patched in [v2.1.14] and [v3.0.1] which you can upgrade to now. If you are already using v3 of Shescape, no further changes are required. If you are using v2 of Shescape it is recommended to upgrade as this version reaches end-of-life status on 2026-09-28, follow the [migration guide] to upgrade to v3. No patches will be released for version of Shescape lower than v2.0.0. Workarounds Alternatively, users of Shescape can 1) refrain from using Dash, 2) use the env option of the node:childprocess API to inject variables with untrusted values instead, or 3) remove all instances of ~ from…
Recommended action: Upgrade to 3.0.1 or 2.1.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This impacts users of Shescape on Windows that explicitly configure shell to CMD, or true with the default shell being CMD, using the escape and escapeAll APIs. An attacker may be able to achieve shell injection depending on the original command. Patches This bug has been patched in [v2.1.14] and [v3.0.1] which you can upgrade to now. If you are already using v3 of Shescape, no further changes are required. If you are using v2 of Shescape is recommended to upgrade as this version reaches end-of-life status on 2026-09-28, follow the [migration guide] to upgrade to v3. No patches will be released for version of Shescape lower than v2.0.0. Workarounds Alternatively, users of Shescape can remove all instances of ( and ) from untrusted inputs. For more information - Comment on Pull Request [#2651] for v2 and [#2649] for v3 - Comment on commit [b4b34c3] for v2 and [43d70b5] for v3 - Open an issue at <https://github.com/ericcornelissen/shescape/issues (New issue Question)
Recommended action: Upgrade to 3.0.1 or 2.1.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used to leak more information. Without option / with MAGICEQUALSUBST With EXTENDEDGLOB Patches This bug has been patched in [v2.1.14] and [v3.0.1] which you can upgrade to now. If you are already using v3 of Shescape, no further changes are required. If you are using v2 of Shescape it is recommended to upgrade as this version reaches end-of-life status on 2026-09-28, follow the [migration guide] to upgrade to v3. No patches will be released for version of Shescape lower than v2.0.0. Workarounds Alternatively, users of Shescape can 1) refrain from using Zsh,…
Recommended action: Upgrade to 3.0.1 or 2.1.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Shescape#escape() does not escape square-bracket glob syntax for Bash, BusyBox sh, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like secret[12] to expand into multiple filesystem matches instead of a single literal argument, turning one argument into multiple trusted-pathname matches. Details The unquoted Unix escape helpers never add [ or ] to their “special characters” regexes: - src/internal/unix/bash.js:14-30 - src/internal/unix/busybox.js:14-30 - src/internal/unix/dash.js:12-19 They escape /? but not brackets, so new Shescape({ shell: "/usr/bin/bash" }).escape("secret[12]") still produces secret[12]. The fixtures (test/fixtures/unix.js:2236-2265, 3496-3525, 5762-5792) are currently written to expect literal brackets for these shells, confirming the behavior. The documentation recommends Shescape#escape() as the fallback for exec when quoting isn’t possible (docs/recipes.md:154-183).…
Recommended action: Upgrade to 2.1.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This impact users of Shescape on Windows that explicitly configure shell: 'cmd.exe' or shell: true using any of quote/quoteAll/escape/escapeAll. An attacker may be able to get read-only access to environment variables. Example: For Shescape prior to v2.0.0, the options object must have shell: 'cmd.exe' or shell: undefined and interpolation: true. Patches This bug has been patched in v2.1.2 which you can upgrade to now. If you are already using v2 of Shescape, no further changes are required. If you are using v1 of Shescape, follow the migration guide to upgrade to v2. There is no plan to release a patch compatible with v1 of Shescape. Workarounds Alternatively, users can remove all instances of % from user input before using Shescape. References - Shescape Pull Request #1916 - Shescape commit 0a81f1e - Shescape release v2.1.2 For more information - Comment on Pull Request #1916 - Comment on commit 0a81f1e - Open an issue at https://github.com/ericcornelissen/shescape/issues…
Recommended action: Upgrade to 2.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This may impact users that use Shescape on Windows in a threaded context (e.g. using Worker threads). The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell. This snippet demonstrates a vulnerable use of Shescape: Patches This bug has been patched in v1.7.4 which you can upgrade to now. No further changes are required. Workarounds If you are impacted there is no workaround possible. References - Shescape Pull Request #1142 - Shescape commit 0b976da - Shescape release v1.7.4 For more information - Comment on Pull Request #1142 - Comment on commit 0b976da - Open an issue at https://github.com/ericcornelissen/shescape/issues (New issue Question Get started)
Recommended action: Upgrade to 1.7.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This impact users of Shescape: 1. On Windows using the Windows Command Prompt (i.e. cmd.exe), and 2. Using quote/quoteAll or escape/escapeAll with the interpolation option set to true. An attacker may be able to get read-only access to environment variables. Example: Patches This bug has been patched in v1.7.1 which you can upgrade to now. No further changes are required. Workarounds Alternatively, users can remove all instances of % from user input, either before or after using Shescape. References - Shescape Pull request #982 - Shescape commit d0fce70 - Shescape Release v1.7.1
Recommended action: Upgrade to 1.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This impacts users that use shescape to escape arguments: - for the Unix shell Bash, or any not-officially-supported Unix shell; - using the escape or escapeAll functions with the interpolation option set to true. An attacker can cause polynomial backtracking in terms of the input string length due to a Regular Expression in shescape that is vulnerable to Regular Expression Denial of Service (ReDoS). Example: Patches This bug has been patched in v1.6.1 which you can upgrade to now. No further changes required. Workarounds Alternatively, a maximum length can be enforced on input strings to shescape to reduce the impact of the vulnerability. It is not recommended to try and detect vulnerable input strings, as the logic for this may end up being vulnerable to ReDoS itself. References - Shescape commit 552e8ea - Shescape Release v1.6.1 For more information - Comment on commit 552e8ea - Open an issue at https://github.com/ericcornelissen/shescape/issues (New issue Question Get…
Recommended action: Upgrade to 1.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This only impacts users that use the escape or escapeAll functions with the interpolation option set to true. Example: The result is that if an attacker is able to include whitespace in their input they can: 1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace. - Affected shells: Bash, Dash, Zsh, PowerShell 2. Invoke shell-specific behaviour through shell-specific special characters inserted or appearing after line terminating characters. - Affected shells: Bash 3. Invoke arbitrary commands by inserting a line feed character. - Affected Shells: Bash, Dash, Zsh, PowerShell 3. Invoke arbitrary commands by inserting a carriage return character. - Affected Shells: PowerShell Patches Behaviour number 1 has been patched in [v1.5.7] which you can upgrade to now. No further changes are required. Behaviour number 2, 3, and 4 have been patched in [v1.5.8] which you can upgrade to now. No further changes are required. Workarounds…
Recommended action: Upgrade to 1.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows. An attacker can omit all arguments following their input by including a line feed character ('\n') in the payload. Example: Note: execSync is just illustrative here, all of exec, execFile, execFileSync, fork, spawn, and spawnSync can be attacked using a line feed character if CMD is the shell being used. Patches This bug has been patched in [v1.5.8] which you can upgrade to now. No further changes are required. Workarounds Alternatively, line feed characters ('\n') can be stripped out manually or the user input can be made the last argument (this only limits the impact). References - https://github.com/ericcornelissen/shescape/pull/332 - https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8 For more information If you have any questions or comments about this advisory: - Comment on https://github.com/ericcornelissen/shescape/pull/332 - Open an issue at…
Recommended action: Upgrade to 1.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The issue allows for exposure of the home directory on Unix systems when using Bash with the escape or escapeAll functions from the shescape API with the interpolation option set to true. Other tested shells, Dash and Zsh, are not affected. Depending on how the output of shescape is used, directory traversal may be possible in the application using shescape. Patches The issue was patched in v1.5.1. Workarounds Manually escape all instances of the tilde character (~) using arg.replace(/~/g, "\\~"). References See GitHub issue https://github.com/ericcornelissen/shescape/issues/169.
Recommended action: Upgrade to 1.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Anyone using Shescape to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a null character into the payload. For example (on Windows): Patches The problem has been patched in v1.1.3 which you can upgrade to now. No further changes are required. Workarounds Alternatively, null characters can be stripped out manually using e.g. arg.replace(/\u{0}/gu, "")
Recommended action: Upgrade to 1.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.