Is CVE-2022-31180 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-31180 being exploited in the wild.

How severe is CVE-2022-31180?

Low severity, with a CVSS score of 3.1, published 15 July 2022.

Which products and versions are affected?

shescape (npm) SEMVER:introduced=1.4.0,fixed=1.5.8.

Is there a fix for CVE-2022-31180?

Yes. shescape (npm): upgrade to 1.5.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-31180 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-31180?

Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-31180: Shescape insufficient escaping of whitespace in interpolation mode

CVE-2022-31180 · Severity: low · CVSS 3.1 · Published 2022-07-15

Shescape is a Node.js library that sanitizes user input for safe shell command execution. When using the interpolation mode feature, the library fails to properly escape whitespace characters, allowing attackers to inject shell commands. An attacker who can control input to an application using this library with interpolation enabled can execute arbitrary commands with the privileges of the application.

Technologies: shescape (npm). Vendors: npm.

Quick answers

Is CVE-2022-31180 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-31180 being exploited in the wild.
How severe is CVE-2022-31180?: Low severity, with a CVSS score of 3.1, published 15 July 2022.
Which products and versions are affected?: shescape (npm) SEMVER:introduced=1.4.0,fixed=1.5.8.
Is there a fix for CVE-2022-31180?: Yes. shescape (npm): upgrade to 1.5.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-31180 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-31180?: Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

shescape (npm): upgrade to 1.5.8 or later
```
npm install shescape@1.5.8
```

Technical details

Shescape's escape() and escapeAll() functions with the interpolation option enabled fail to neutralize control sequences after whitespace characters. The vulnerability allows attackers to inject shell-specific metacharacters after whitespace (e.g., "#" for comments), line feed and carriage return characters to execute arbitrary commands. This affects Bash, Dash, Zsh, and PowerShell. The vulnerability requires that the application be using interpolation mode and that user-controlled input reaches the vulnerable escaping functions. Patches were released in versions 1.5.7 (partial fix) and 1.5.8 (complete fix). Workarounds include avoiding interpolation mode where possible or stripping whitespace from user input, though the latter approach is error-prone.

Affected products

ericcornelissen shescape >=1.4.0 <1.5.8

Identifiers

CVE-2022-31180
GHSA-44vr-rwwj-p88h

Timeline

2022-07-15: disclosed
2022-07-06: patched: Partial patch in v1.5.7
2022-07-15: patched: Complete patch in v1.5.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.