shescape@0.4.1 vulnerabilities

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Improper Neutralization due to possible escaping the wrong shell, thus allowing attackers to bypass protections. Note: you are only vulnerable if you are using this package on Windows in a threaded context.

Upgrade shescape to version 1.7.4 or higher.

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Information Exposure such that an attacker may be able to get read-only access to environment variables.

Note:

This impact users of Shescape:

1. On Windows using the Windows Command Prompt (i.e. cmd.exe), and
2. Using quote/quoteAll or escape/escapeAll with the interpolation option set to true.

Upgrade shescape to version 1.7.1 or higher.

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Remote Code Execution (RCE) on Windows, when processing cmd.exe commands. An attacker can cause all arguments following their input to be ignored by including a line feed character ('\n') in the input.

Upgrade shescape to version 1.5.8 or higher.

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Arbitrary Code Execution. Module vulnerable against shell injection if the attacker manages to insert a null character into the payload.

Upgrade shescape to version 1.1.3 or higher.