shescape@1.5.7 vulnerabilities

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Improper Neutralization due to possible escaping the wrong shell, thus allowing attackers to bypass protections. Note: you are only vulnerable if you are using this package on Windows in a threaded context.

Upgrade shescape to version 1.7.4 or higher.

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Information Exposure such that an attacker may be able to get read-only access to environment variables.

Note:

This impact users of Shescape:

1. On Windows using the Windows Command Prompt (i.e. cmd.exe), and
2. Using quote/quoteAll or escape/escapeAll with the interpolation option set to true.

Upgrade shescape to version 1.7.1 or higher.

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape() and escapeAll() functions.

Upgrade shescape to version 1.5.10 or higher.

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Arbitrary Command Execution for systems using the escape or escapeAll functions with the interpolation option set to true, on Bash, Dash, Zsh, or Powershell shells. Under those conditions, an attacker can cause arbitrary commands to be executed by including them after certain whitespace characters in their input.

NOTE:
The undesirable behavior is mitigated partially in version 1.5.7 but fully removed in version 1.5.8. It can also be worked around by eliminating use of the interpolation: true option.

Upgrade shescape to version 1.5.8 or higher.

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Remote Code Execution (RCE) on Windows, when processing cmd.exe commands. An attacker can cause all arguments following their input to be ignored by including a line feed character ('\n') in the input.

Upgrade shescape to version 1.5.8 or higher.