shescape

### Impact This impacts users of Shescape on Unix systems that explicitly configure `shell` to Zsh, or `true` when the default shell is Zsh, using the `escape` and `escapeAll`. The Zsh options `EXTENDED_GLOB` and `MAGIC_EQUAL_SUBST` exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used to leak more information. #### Without option / with `MAGIC_EQUAL_SUBST` ```javascript import * as cp from "node:child_process"; import {

CVE: CVE-2026-73412

### Impact This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the API being used. An attacker can cause a runtime quadratic in the input size, causing denial of service for large inputs. ```javascript import { Shescape } from "shescape"; // 1. Prerequisites const options = { //flagProtection unspecified // Or flagProtection: true, }; // 2. Payload let payload = "\u0000-".repeat(32000); // 3. Usage const shescape = new Shescape(options); let callback; callback = () => shescape.escape(payload); // Or callback = () => shescap

CVE: CVE-2026-73413

### Impact This impacts users of Shescape on Unix systems that explicitly configure `shell` to Dash, or `true` when the default shell is Dash, using the `escape` and `escapeAll` APIs in assignments prefixed to a command. An attacker may be able to obtain the location of the home directory and, depending on how it is used, change the location on which a command operates in unexpected ways. ```javascript import * as cp from "node:child_process"; import { Shescape } from "shescape"; // 1. Prerequisites const options = { shell: "dash", // Or shell: true, // Only if the default shel

CVE: CVE-2026-73411

### Impact This impacts users of Shescape on Windows that explicitly configure `shell` to CMD, or `true` with the default shell being CMD, using the `escape` and `escapeAll` APIs. An attacker may be able to achieve shell injection depending on the original command. ```javascript import * as cp from "node:child_process"; import { Shescape } from "shescape"; // 1. Prerequisites const options = { shell: "cmd.exe", // Or shell: true, // Only if the default shell is CMD }; // 2. Payload const payload = "x) else if a==a (echo y"; // 3. Usage const shescape = new Shescape(options);

CVE: CVE-2026-73414

### Summary `Shescape#escape()` does not escape square-bracket glob syntax for Bash, BusyBox `sh`, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like `secret[12]` to expand into multiple filesystem matches instead of a single literal argument, turning one argument into multiple trusted-pathname matches. ### Details The unquoted Unix escape helpers never add `[` or `]` to their “special characters” regexes: - `src/internal/unix/bash.js:14-30` - `src/internal/unix/busybox.js:14-30` - `src/internal/unix/das

CVE: CVE-2026-32094

## Withdrawn Advisory This advisory has been withdrawn because it falls outside the https://github.com/ericcornelissen/shescape/blob/a2544a1c78cae19d0e81a485b997bf0b0fcc2c12/SECURITY.md#threat-model. This link is maintained to preserve external references. ## Original Description ### Impact This impacts users of Shescape that configure their `shell` to point to a file on disk that is a link to a link. The precise result of being affected depends on the actual shell used and incorrect shell identified by Shescape. In particular, an attacker may be able to bypass escaping for the shell being

CVE: CVE-2026-30916

### Impact This impact users of Shescape on Windows that explicitly configure `shell: 'cmd.exe'` or `shell: true` using any of `quote`/`quoteAll`/`escape`/`escapeAll`. An attacker may be able to get read-only access to environment variables. Example: ```javascript import * as cp from "node:child_process"; import { Shescape } from "shescape"; // 1. Prerequisites const shescape = new Shescape({ shell: "cmd.exe", // Or shell: true, // Only if the default shell is CMD }); // 2. Payload const payload = '"%PATH%'; // 3. Usage let escapedPayload; escapedPayload = shescape.quote(pay

CVE: CVE-2025-30222

### Impact This may impact users that use Shescape on Windows in a threaded context (e.g. using [Worker threads](https://nodejs.org/api/worker_threads.html)). The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell. This snippet demonstrates a vulnerable use of Shescape: ```javascript // vulnerable.js import { exec } from "node:child_process"; import { Worker, isMainThread } from 'node:worker_threads'; import * as shescape from "shescape"; if (isMainThread) {

CVE: CVE-2023-40185

### Impact This impact users of Shescape: 1. On Windows using the Windows Command Prompt (i.e. `cmd.exe`), and 2. Using `quote`/`quoteAll` or `escape`/`escapeAll` with the `interpolation` option set to `true`. An attacker may be able to get read-only access to environment variables. Example: ```javascript import * as cp from "node:child_process"; import * as shescape from "shescape"; // 1. Prerequisites const options = { shell: "cmd.exe", // Or shell: undefined, // Only if the default shell is CMD // And interpolation: true, // Only applies to `escape` and `escapeAll`

CVE: CVE-2023-35931

### Impact This impacts users that use shescape to escape arguments: - for the Unix shell Bash, or any not-officially-supported Unix shell; - using the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. An attacker can cause polynomial backtracking in terms of the input string length due to a Regular Expression in shescape that is vulnerable to Regular Expression Denial of Service (ReDoS). Example: ```javascript import * as shescape from "shescape"; /* 1. Prerequisites */ const options = { interpolation: true, // and shell: "/bin/bash", // or shell:

CVE: CVE-2022-25918