Priority LOW 36
Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00355 · Published 2026-08-15 · Fixed in 2.1.15, 3.0.2 CWE-116
Priority MEDIUM 49
Shescape is a simple shell escape library for JavaScript.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.00889 · Published 2026-08-12 · Fixed in 2.1.14, 3.0.1 CWE-150
Priority MEDIUM 44
Shescape is a simple shell escape library for JavaScript.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0059 · Published 2026-08-12 · Fixed in 2.1.14, 3.0.1 CWE-400
Priority LOW 29
Shescape is a simple shell escape library for JavaScript.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00612 · Published 2026-08-12 · Fixed in 2.1.14, 3.0.1 CWE-155
Priority LOW 29
Shescape is a simple shell escape library for JavaScript.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0059 · Published 2026-08-12 · Fixed in 2.1.14, 3.0.1 CWE-116
Priority HIGH 70
Shescape is a simple shell escape library for JavaScript.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00251 · Published 2026-03-11 · Fixed in 2.1.10 CWE-200
Priority MEDIUM 44
Shescape is a simple shell escape library for JavaScript.
CVSS 4.0LOW 2.1· Local · No auth · No interaction · EPSS 0.00193 · Published 2025-03-25 · Fixed in 2.1.2 CWE-200
Priority LOW 38
shescape is simple shell escape library for JavaScript.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00675 · Published 2023-08-23 · Fixed in 1.7.4 CWE-150
Priority LOW 22
Shescape is a simple shell escape library for JavaScript.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00811 · Published 2023-06-23 · Fixed in 1.7.1 CWE-526
Priority HIGH 72
The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01629 · Published 2022-10-27 · Fixed in 1.6.1 CWE-1333
Priority HIGH 66
Shescape is a shell escape package for JavaScript.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01459 · Published 2022-09-06 · Fixed in 1.5.10 CWE-1333
Priority HIGH 75
Shescape is a simple shell escape package for JavaScript.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01424 · Published 2022-08-01 · Fixed in 1.5.8 CWE-74
Priority HIGH 82
Shescape is a simple shell escape package for JavaScript.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01993 · Published 2022-08-01 · Fixed in 1.5.8 CWE-74
Priority MEDIUM 61
Shescape is a shell escape package for JavaScript.
CVSS 3.1MEDIUM 6.2· Local · No auth · No interaction · EPSS 0.00499 · Published 2022-03-03 · Fixed in 1.5.1 CWE-200
Priority LOW 35
shescape is a simple shell escape package for JavaScript.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00578 · Published 2021-03-18 · Fixed in 1.1.3 CWE-88
Priority MEDIUM 44
In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if they can control the value of [the `tag` input] or manage to alter the value of […
CVSS 3.1CRITICAL 9.6· Network · Low privileges · No interaction · EPSS 0.01175 · Published 2020-10-26 · Fixed in 1.0.1 CWE-78
THREATIST.IORead the docs