Shescape on Windows escaping may be bypassed in threaded context
Priority LOW 38CWE-150Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell. This bug has been patched in version 1.7.4.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00675 52nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed shescape (ericcornelissen): 1.7.4shescape (npm): 1.7.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ericcornelissen | shescape | before 1.7.4 | 1.7.4 | Patch available | CNA |
| — | shescape (npm) | before 1.7.4 | 1.7.4 | Patch available | GHSA-j55r-787p-m549 |
- shescape Vendorericcornelissen Affected before 1.7.4 Fixed in 1.7.4 Patch available CNA
- shescape (npm) Vendor— Affected before 1.7.4 Fixed in 1.7.4 Patch available GHSA-j55r-787p-m549
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:shescape_project:shescape:*:*:*:*:*:node.js:*:* | before 1.7.4 | Vulnerable | ericcornelissen |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:shescape_project:shescape:*:*:*:*:*:node.js:*:* Versions before 1.7.4 Vulnerable ·ericcornelissen
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA shescape (ericcornelissen) Fixed in 1.7.4
- Fix · GHSA-j55r-787p-m549 shescape (npm) Fixed in 1.7.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-40185
- 2026-10-03 Alias added: GHSA-j55r-787p-m549
References
Patch 2
More ericcornelissen Shescape vulnerabilities
- TI-2022-13220 Insufficient escaping of whitespace in shescape CVSS 3.1CRITICAL 9.8
- TI-2022-13219 Insufficient escaping of line feeds for CMD in shescape CVSS 3.1CRITICAL 9.8
- TI-2022-09469 Regular expression denial of service (ReDoS) in shescape CVSS 3.1HIGH 7.5
- TI-2026-24632 Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash CVSS 4.0MEDIUM 6.9
- TI-2022-16487 Shescape Inefficient Regular Expression Complexity vulnerability CVSS 3.1HIGH 7.5
- TI-2022-08540 Exposure of home directory through shescape on Unix with Bash CVSS 3.1MEDIUM 6.2
Sources
- CVE-2023-40185 · CVE Program
- CVE-2023-40185 · NVD
- FIRST EPSS
- GHSA-j55r-787p-m549 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences