Description
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.9, an attacker may be able to bypass escaping for the shell being used. This can result, for example, in exposure of sensitive information. This impacts users of Shescape that configure their shell to point to a file on disk that is a link to a link. The precise result of being affected depends on the actual shell used and incorrect shell identified by Shescape. This vulnerability is fixed in 2.1.9.
Problem types
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Product status
References
github.com/...escape/security/advisories/GHSA-6f6w-6j58-rq76
github.com/...escape/security/advisories/GHSA-6f6w-6j58-rq76
github.com/ericcornelissen/shescape/pull/2388
www.npmjs.com/package/shescape/v/2.1.9