TI-2022-13219 Aliases CVE-2022-31179 GHSA-jjc5-fp7p-6f8w

Insufficient escaping of line feeds for CMD in shescape

HIGH 75CWE-74Published 2022-08-01 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows An attacker can omit all arguments following their input by including a line feed character (`'\n'`) in the payload. This bug has been patched in [v1.5.8] which you can upgrade to now. No further changes are required. Alternatively, line feed characters (`'\n'`) can be stripped out manually or the user input can be made the last argument (this only limits the impact).

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01424 73rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed shescape (ericcornelissen): 1.5.8shescape (npm): 1.5.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ericcornelissen	shescape	before 1.5.8	1.5.8	Patch available	CNA
—	shescape (npm)	before 1.5.8	1.5.8	Patch available	GHSA-jjc5-fp7p-6f8w

shescape Vendorericcornelissen Affected before 1.5.8 Fixed in 1.5.8 Patch available CNA
shescape (npm) Vendor— Affected before 1.5.8 Fixed in 1.5.8 Patch available GHSA-jjc5-fp7p-6f8w

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:shescape_project:shescape::::::::	before 1.5.8	Vulnerable	ericcornelissen
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:shescape_project:shescape:*:*:*:*:*:*:*:* Versions before 1.5.8 Vulnerable ·ericcornelissen
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

Fix · CNA shescape (ericcornelissen) Fixed in 1.5.8
Fix · GHSA-jjc5-fp7p-6f8w shescape (npm) Fixed in 1.5.8 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-31179
2026-10-03 Alias added: GHSA-jjc5-fp7p-6f8w

References

Exploit 1

https://github.com/ericcornelissen/shescape/security/advisories/GHSA-jjc5-fp7p-6f8w

Patch 1

https://github.com/ericcornelissen/shescape/pull/332

Advisory 2

Other 2

TI-2022-13220 Insufficient escaping of whitespace in shescape CVSS 3.1CRITICAL 9.8
TI-2022-09469 Regular expression denial of service (ReDoS) in shescape CVSS 3.1HIGH 7.5
TI-2026-24632 Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash CVSS 4.0MEDIUM 6.9
TI-2022-16487 Shescape Inefficient Regular Expression Complexity vulnerability CVSS 3.1HIGH 7.5
TI-2022-08540 Exposure of home directory through shescape on Unix with Bash CVSS 3.1MEDIUM 6.2
TI-2023-21058 Shescape on Windows escaping may be bypassed in threaded context CVSS 3.1HIGH 8.6

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences