# CVE-2023-40185: Shescape shell escaping bypass in threaded context on Windows

Source: https://junglewise.ai/threats/cve-2023-40185-shescape-shell-escaping-bypass-in-threaded-context-on-windows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-08-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-40185 · Severity: low · CVSS 3.1 · Published 2023-08-22

Shescape is a Node.js library that protects against shell injection attacks by escaping user input for various shells (PowerShell, CMD, etc.). On Windows systems, when Shescape is used in worker threads, it may incorrectly detect which shell is in use and apply the wrong escaping rules. An attacker can exploit this mismatch to bypass security protections and execute arbitrary shell commands.

Technologies: [shescape (npm)](https://junglewise.ai/threats/technologies/shescape). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-40185 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-40185 being exploited in the wild.

**How severe is CVE-2023-40185?** Low severity, with a CVSS score of 3.1, published 22 August 2023.

**Which products and versions are affected?** shescape (npm) SEMVER:introduced=0,fixed=1.7.4.

**Is there a fix for CVE-2023-40185?** Yes. shescape (npm): upgrade to 1.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-40185 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-40185?** Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- shescape (npm): upgrade to 1.7.4 or later

  ```sh
  npm install shescape@1.7.4
  ```


## Technical details

The vulnerability is an improper neutralization of escape sequences (CWE-150) affecting Shescape's shell detection logic on Windows. When Shescape runs in a worker thread context, environment variable name changes on Windows cause the library to fail to detect the configured shell (e.g., PowerShell) and fall back to a default shell (e.g., CMD), resulting in incorrect escaping rules being applied. An attacker can craft input that bypasses the escaping intended for one shell but executes as a command in another. This affects versions prior to 1.7.4. The vulnerability requires the application to use Shescape in a threaded context on Windows with a mismatch between the expected and detected shell. A patch is available in version 1.7.4 with no known workarounds for affected versions.

## Affected products

- Eric Cornelissen Shescape <1.7.4

## Identifiers

- CVE-2023-40185
- GHSA-j55r-787p-m549

## Timeline

- 2023-08-22: disclosed
- 2023-08-22: patched: Patched in version 1.7.4

## References

- [https://github.com/ericcornelissen/shescape/security/advisories/GHSA-j55r-787p-m549](https://github.com/ericcornelissen/shescape/security/advisories/GHSA-j55r-787p-m549)

## Related threats

- [Shescape shell injection via unescaped parentheses on Windows CMD](https://junglewise.ai/threats/cve-2026-73414-shescape-shell-injection-via-unescaped-parentheses-on-windows-cmd)
- [Shescape quadratic-time denial of service in flag-protection](https://junglewise.ai/threats/cve-2026-73413-shescape-quadratic-time-denial-of-service-in-flag-protection)
- [Shescape path disclosure on Unix with Zsh](https://junglewise.ai/threats/cve-2026-73412-shescape-path-disclosure-on-unix-with-zsh)
- [Shescape home-directory disclosure in Dash shell assignment](https://junglewise.ai/threats/cve-2026-73411-shescape-home-directory-disclosure-in-dash-shell-assignment)
- [Shescape escape() bracket glob expansion bypass on Bash, BusyBox, and Dash](https://junglewise.ai/threats/cve-2026-32094-shescape-escape-bracket-glob-expansion-bypass-on-bash-busybox-and)