Read the docs

ericcornelissen

Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

ericcornelissen records in CISA KEV

No ericcornelissen vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Shescape 9 records HIGH

Records

16 records

TI-2022-09469 CVE-2022-25918 · GHSA-cr84-xvw4-qx3c

Regular expression denial of service (ReDoS) in shescape

Priority HIGH 72

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01629 Published 2022-10-27 Fixed in 1.6.1 CWE-1333
TI-2020-12042 CVE-2020-15272

Shell-injection in git-tag-annotation GitHub action

Priority MEDIUM 44

In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if they can control the value of [the `tag` input] or manage to alter the value of […

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01175 Published 2020-10-26 Fixed in 1.0.1 CWE-78
TI-2026-51264 CVE-2026-73055 · GHSA-jfpg-hfv5-2rf7

Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox

Priority LOW 36

Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00355 Published 2026-08-15 Fixed in 2.1.15, 3.0.2 CWE-116
TI-2021-04483 CVE-2021-21384 · GHSA-f2rp-38vg-j3gh

Null characters not escaped in shescape

Priority LOW 35

shescape is a simple shell escape package for JavaScript.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00578 Published 2021-03-18 Fixed in 1.1.3 CWE-88
TI-2026-51530 CVE-2026-73412 · GHSA-6v4m-fw66-8r4x

Shescape: Path disclosure on Unix with Zsh

Priority LOW 29

Shescape is a simple shell escape library for JavaScript.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00612 Published 2026-08-12 Fixed in 2.1.14, 3.0.1 CWE-155
Open these records in search →