Alta

Shescape prior to 1.5.8 vulnerable to insufficient escaping of line feeds for CMD

Publicada: 15.07.2022
Actualizado: 11.10.2026 10:22

Impact

This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows. An attacker can omit all arguments following their input by including a line feed character ('\n') in the payload. Example:

import cp from "node:child_process";
import * as shescape from "shescape";

// 1. Prerequisites
const options = {
  shell: "cmd.exe",
};

// 2. Attack
const payload = "attacker\n";

// 3. Usage
let escapedPayload;
escapedPayload = shescape.escape(payload, options);
// Or
escapedPayload = shescape.escapeAll([payload], options)[0];
// Or
escapedPayload = shescape.quote(payload, options);
// Or
escapedPayload = shescape.quoteAll([payload], options)[0];

cp.execSync(`echo Hello ${escapedPayload}! How are you doing?`, options);
// Outputs:  "Hello attacker"

Note: execSync is just illustrative here, all of exec, execFile, execFileSync, fork, spawn, and spawnSync can be attacked using a line feed character if CMD is the shell being used.

Patches

This bug has been patched in v1.5.8 which you can upgrade to now. No further changes are required.

Workarounds

Alternatively, line feed characters ('\n') can be stripped out manually or the user input can be made the last argument (this only limits the impact).

References

For more information

If you have any questions or comments about this advisory:

Comment on https://github.com/ericcornelissen/shescape/pull/332
Open an issue at https://github.com/ericcornelissen/shescape/issues (New issue > Question > Get started)

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Paquete de npm	shescape	< 1.5.8	1.5.8

Referencias

Puntuación CVSS 8.1/10

Vector CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H
Debilidad (CWE): CWE-74
Plataforma: npm
Paquete: shescape
Publicada: 15.07.2022
Actualizado: 11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-jjc5-fp7p-6f8w - CC BY 4.0

Historial de vulnerabilidades: shescape

Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (13) en el archivo

Entradas en total: 13
Primera → última: 03.2021 07.2026
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Crítica 2
Alta 5
Media 4
Baja 2

Divulgaciones por año

2021: 1
2022: 4
2023: 2
2024: 0
2025: 1
2026: 5

24.07.2026

Shescape: Quadratic-time denial of service in the flag-protection

Alta CVE-2026-73413 >= 2.1.11, < 2.1.14, >= 3.0.0, < 3.0.1 2.1.14, 3.0.1
24.07.2026

Shescape: Shell injection via unescaped parentheses on Windows with CMD

Crítica CVE-2026-73414 < 2.1.14, >= 3.0.0, < 3.0.1 2.1.14, 3.0.1
22.08.2023

Shescape on Windows escaping may be bypassed in threaded context

Alta · 8.6 CVE-2023-40185 < 1.7.4 1.7.4
25.10.2022

Inefficient Regular Expression Complexity in shescape

Alta · 7.5 CVE-2022-25918 >= 1.5.10, < 1.6.1 1.6.1
15.07.2022

Shescape vulnerable to insufficient escaping of whitespace

Crítica · 9.8 CVE-2022-31180 >= 1.4.0, < 1.5.8 1.5.8
15.07.2022

Shescape prior to 1.5.8 vulnerable to insufficient escaping of line feeds for CMD esta entrada

Alta · 8.1 CVE-2022-31179 < 1.5.8 1.5.8
18.03.2021

Null characters not escaped

Alta · 6.3 CVE-2021-21384 < 1.1.3 1.1.3

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación