Description
Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1.
References7
- github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd0…
- github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775b…
- github.com/ericcornelissen/shescape/pull/2649
- github.com/ericcornelissen/shescape/pull/2651
- github.com/ericcornelissen/shescape/releases/tag/v2.1.14
- github.com/ericcornelissen/shescape/releases/tag/v3.0.1
- github.com/ericcornelissen/shescape/security/advisories/GHSA-gm…
Metrics
- CVSS 4.0
-
8.7
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 49 · as of 12 November 2026
- CWE
- CWE-400CWE-407
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.