# CVE-2022-31179: Shescape insufficient escaping of line feeds in CMD

Source: https://junglewise.ai/threats/cve-2022-31179-shescape-insufficient-escaping-of-line-feeds-in-cmd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-07-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-31179 · Severity: low · CVSS 3.1 · Published 2022-07-15

Shescape is a library used to safely escape command-line arguments when executing shell commands from Node.js applications. In versions prior to 1.5.8, the library fails to properly escape line feed characters when preparing arguments for Windows cmd.exe, allowing an attacker to inject newline characters that terminate the command early and drop all following arguments. This can be exploited to bypass intended command structure and execute unintended logic when processing user-controlled input.

Technologies: [shescape (npm)](https://junglewise.ai/threats/technologies/shescape). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-31179 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-31179 being exploited in the wild.

**How severe is CVE-2022-31179?** Low severity, with a CVSS score of 3.1, published 15 July 2022.

**Which products and versions are affected?** shescape (npm) SEMVER:introduced=0,fixed=1.5.8.

**Is there a fix for CVE-2022-31179?** Yes. shescape (npm): upgrade to 1.5.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-31179 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-31179?** Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- shescape (npm): upgrade to 1.5.8 or later

  ```sh
  npm install shescape@1.5.8
  ```


## Technical details

The vulnerability is an improper neutralization of escape/control sequences (CWE-74) affecting Shescape's cmd.exe escaping logic. The root cause is insufficient filtering of line feed characters ('\n') in the escape, escapeAll, quote, and quoteAll API functions when the shell option is set to "cmd.exe". An attacker can include a newline in user-supplied input that reaches these functions, causing cmd.exe to interpret it as a command separator, thereby truncating the intended command and omitting all arguments that follow. The vulnerability is network-reachable if user input is passed through Shescape to shell execution, with no authentication required. An attacker can achieve arbitrary command structure manipulation and argument injection/omission. The fix was released in version 1.5.8.

## Affected products

- Eric Cornelissen Shescape prior to 1.5.8

## Identifiers

- CVE-2022-31179
- GHSA-jjc5-fp7p-6f8w

## Timeline

- 2022-07-15: disclosed
- 2022-07-15: patched: v1.5.8 released

## References

- [https://github.com/ericcornelissen/shescape/security/advisories/GHSA-jjc5-fp7p-6f8w](https://github.com/ericcornelissen/shescape/security/advisories/GHSA-jjc5-fp7p-6f8w)

## Related threats

- [Shescape shell injection via unescaped parentheses on Windows CMD](https://junglewise.ai/threats/cve-2026-73414-shescape-shell-injection-via-unescaped-parentheses-on-windows-cmd)
- [Shescape quadratic-time denial of service in flag-protection](https://junglewise.ai/threats/cve-2026-73413-shescape-quadratic-time-denial-of-service-in-flag-protection)
- [Shescape path disclosure on Unix with Zsh](https://junglewise.ai/threats/cve-2026-73412-shescape-path-disclosure-on-unix-with-zsh)
- [Shescape home-directory disclosure in Dash shell assignment](https://junglewise.ai/threats/cve-2026-73411-shescape-home-directory-disclosure-in-dash-shell-assignment)
- [Shescape escape() bracket glob expansion bypass on Bash, BusyBox, and Dash](https://junglewise.ai/threats/cve-2026-32094-shescape-escape-bracket-glob-expansion-bypass-on-bash-busybox-and)