Homepage

shescape@1.5.0 vulnerabilities

simple shell escape library

  • latest version

    2.1.1

  • latest non vulnerable version

    2.1.1

  • first published

    4 years ago

  • latest version published

    7 months ago

  • licenses detected

  • View shescape package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the shescape package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Improper Neutralization

    shescape is a simple shell escape library

    Affected versions of this package are vulnerable to Improper Neutralization due to possible escaping the wrong shell, thus allowing attackers to bypass protections. Note: you are only vulnerable if you are using this package on Windows in a threaded context.

    How to fix Improper Neutralization?

    Upgrade shescape to version 1.7.4 or higher.

    <1.7.4
    • M
    Information Exposure

    shescape is a simple shell escape library

    Affected versions of this package are vulnerable to Information Exposure such that an attacker may be able to get read-only access to environment variables.

    Note:

    This impact users of Shescape:

    1. On Windows using the Windows Command Prompt (i.e. cmd.exe), and
    2. Using quote/quoteAll or escape/escapeAll with the interpolation option set to true.

    How to fix Information Exposure?

    Upgrade shescape to version 1.7.1 or higher.

    <1.7.1
    • H
    Arbitrary Command Execution

    shescape is a simple shell escape library

    Affected versions of this package are vulnerable to Arbitrary Command Execution for systems using the escape or escapeAll functions with the interpolation option set to true, on Bash, Dash, Zsh, or Powershell shells. Under those conditions, an attacker can cause arbitrary commands to be executed by including them after certain whitespace characters in their input.

    NOTE:
    The undesirable behavior is mitigated partially in version 1.5.7 but fully removed in version 1.5.8. It can also be worked around by eliminating use of the interpolation: true option.

    How to fix Arbitrary Command Execution?

    Upgrade shescape to version 1.5.8 or higher.

    >=1.4.0 <1.5.8
    • M
    Remote Code Execution (RCE)

    shescape is a simple shell escape library

    Affected versions of this package are vulnerable to Remote Code Execution (RCE) on Windows, when processing cmd.exe commands. An attacker can cause all arguments following their input to be ignored by including a line feed character ('\n') in the input.

    How to fix Remote Code Execution (RCE)?

    Upgrade shescape to version 1.5.8 or higher.

    <1.5.8
    • L
    Information Exposure

    shescape is a simple shell escape library

    Affected versions of this package are vulnerable to Information Exposure due to possible exposure of the home directory.

    How to fix Information Exposure?

    Upgrade shescape to version 1.5.1 or higher.

    >=1.4.0 <1.5.1
    Go back to all versions of this package