CVE-2023-35931lowCWE-526

CVE-2023-35931: falha de baixa gravidade em ericcornelissen shescape

Shescape potential environment variable exposure on Windows with CMD

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar shescape+ Monitorar shescape

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.1epss 0.8%
Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
ericcornelissen · shescape
CVEs relacionadas — ericcornelissen shescape

No mesmo produto, das mais perigosas para as menos.

CVE-2022-31180CRITICALInsufficient escaping of whitespace in shescapeEPSS 2.0%CVE-2022-36064MEDIUMShescape Inefficient Regular Expression Complexity vulnerabilityEPSS 1.5%CVE-2022-31179HIGHInsufficient escaping of line feeds for CMD in shescapeEPSS 1.4%CVE-2026-73414CRITICALShescape: Shell injection via unescaped parentheses on Windows with CMDEPSS 0.9%CVE-2023-40185MEDIUMShescape on Windows escaping may be bypassed in threaded contextEPSS 0.7%CVE-2026-73412MEDIUMShescape: Path disclosure on Unix with ZshEPSS 0.6%