Shescape Project
Shescape Project Shescape: vulnerabilidades y CVE
Shescape Project Shescape tiene 9 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE9
Últimos 12 meses1
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-32094 | Media (6.9) | 0.30% | — | 11 mar 2026 | Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-bracket glob syntax for Bash, BusyBox sh, and Dash. Applications that interpolate the return value… |
| CVE-2023-40185 | Alta (8.6) | 0.68% | — | 23 ago 2023 | shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus… |
| CVE-2023-35931 | Media (4.3) | 0.81% | — | 23 jun 2023 | Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1. |
| CVE-2022-25918 | Alta (7.5) | 1.4% | — | 27 oct 2022 | The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function. |
| CVE-2022-36064 | Alta (7.5) | 1.4% | — | 6 sept 2022 | Shescape is a shell escape package for JavaScript. An Inefficient Regular Expression Complexity vulnerability impacts users that use Shescape to escape arguments for the Unix shells `Bash` and `Dash`, or any… |
| CVE-2022-31180 | Crítica (9.8) | 1.9% | — | 1 ago 2022 | Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the `escape` or… |
| CVE-2022-31179 | Crítica (9.8) | 1.4% | — | 1 ago 2022 | Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users that use Shescape (any API function) to escape arguments for… |
| CVE-2022-24725 | Media (5.5) | 0.50% | — | 3 mar 2022 | Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the… |
| CVE-2021-21384 | Alta (7.8) | 0.58% | — | 19 mar 2021 | shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker… |