Read the docs
TI-2022-16487 Aliases CVE-2022-36064

Shescape Inefficient Regular Expression Complexity vulnerability

Priority HIGH 66CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-1333.

Summary

Shescape is a shell escape package for JavaScript. An Inefficient Regular Expression Complexity vulnerability impacts users that use Shescape to escape arguments for the Unix shells `Bash` and `Dash`, or any not-officially-supported Unix shell; and/or using the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. An attacker can cause polynomial backtracking or quadratic runtime in terms of the input string length due to two Regular Expressions in Shescape that are vulnerable to Regular Expression Denial of Service (ReDoS). This bug has been patched in v1.5.10. For `Dash` only, this bug has been patched since v1.5.9. As a workaround, a maximum length can be enforced on input strings to Shescape to reduce the impact of the vulnerability. It is not recommended to try and detect vulnerable input strings, as the logic for this may end up being vulnerable to ReDoS itself.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01459 73rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed shescape (ericcornelissen): 1.5.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ericcornelissenshescape1.5.1 to before 1.5.101.5.10Patch availableCNA
  • shescape Vendorericcornelissen Affected 1.5.1 to before 1.5.10 Fixed in 1.5.10 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:shescape_project:shescape:*:*:*:*:*:node.js:*:*1.5.1 to before 1.5.10Vulnerableericcornelissen
  • cpe:2.3:a:shescape_project:shescape:*:*:*:*:*:node.js:*:* Versions 1.5.1 to before 1.5.10 Vulnerable ·ericcornelissen

Remediation

  • Fix · CNA shescape (ericcornelissen) Fixed in 1.5.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36064

References

Exploit 1

Patch 1

Advisory 1

  • TI-2022-13220 Insufficient escaping of whitespace in shescape CVSS 3.1CRITICAL 9.8
  • TI-2022-13219 Insufficient escaping of line feeds for CMD in shescape CVSS 3.1CRITICAL 9.8
  • TI-2022-09469 Regular expression denial of service (ReDoS) in shescape CVSS 3.1HIGH 7.5
  • TI-2026-24632 Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash CVSS 4.0MEDIUM 6.9
  • TI-2022-08540 Exposure of home directory through shescape on Unix with Bash CVSS 3.1MEDIUM 6.2
  • TI-2023-21058 Shescape on Windows escaping may be bypassed in threaded context CVSS 3.1HIGH 8.6
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences