CVE-2026-73413highCWE-400CWE-407

CVE-2026-73413: fallo de gravedad alta en ericcornelissen shescape

Shescape: Quadratic-time denial of service in flag-protection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear shescape+ Monitorear shescape

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.6%
Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
ericcornelissen · shescape
CVEs relacionadas — ericcornelissen shescape

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-31180CRITICALInsufficient escaping of whitespace in shescapeEPSS 2.0%CVE-2022-36064MEDIUMShescape Inefficient Regular Expression Complexity vulnerabilityEPSS 1.5%CVE-2022-31179HIGHInsufficient escaping of line feeds for CMD in shescapeEPSS 1.4%CVE-2026-73414CRITICALShescape: Shell injection via unescaped parentheses on Windows with CMDEPSS 0.9%CVE-2023-35931LOWShescape potential environment variable exposure on Windows with CMDEPSS 0.8%CVE-2023-40185MEDIUMShescape on Windows escaping may be bypassed in threaded contextEPSS 0.7%