CVE-2025-30222lowCWE-200

CVE-2025-30222: falha de baixa gravidade em ericcornelissen shescape

Shescape has potential environment variable exposure on Windows with CMD

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar shescape+ Monitorar shescape

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.1epss 0.2%
Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure `shell: 'cmd.exe'` or `shell: true` using any of `quote`/`quoteAll`/`escape`/`escapeAll`. An attacker may be able to get read-only access to environment variables. This bug has been patched in v2.1.2. For those who are already using v2 of Shescape, no further changes are required. Those who are are using v1 of Shescape should follow the migration guide to upgrade to v2. There is no plan to release a patch compatible with v1 of Shescape. As a workaround, users can remove all instances of `%` from user input before using Shescape.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Produtos afetados
ericcornelissen · shescape
CVEs relacionadas — ericcornelissen shescape

No mesmo produto, das mais perigosas para as menos.

CVE-2022-31180CRITICALInsufficient escaping of whitespace in shescapeEPSS 2.0%CVE-2022-36064MEDIUMShescape Inefficient Regular Expression Complexity vulnerabilityEPSS 1.5%CVE-2022-31179HIGHInsufficient escaping of line feeds for CMD in shescapeEPSS 1.4%CVE-2026-73414CRITICALShescape: Shell injection via unescaped parentheses on Windows with CMDEPSS 0.9%CVE-2023-35931LOWShescape potential environment variable exposure on Windows with CMDEPSS 0.8%CVE-2023-40185MEDIUMShescape on Windows escaping may be bypassed in threaded contextEPSS 0.7%