CVE-2025-30222: Shescape environment variable exposure on Windows with CMD

CVE-2025-30222 · Severity: medium · CVSS 4 · Published 2025-03-26

Shescape is a Node.js library that safely escapes command-line arguments for shell execution. On Windows systems using CMD.exe, the library fails to properly filter percent signs (%) in user input, allowing attackers to read environment variables through CMD's variable expansion syntax. This could expose sensitive information like API keys or system paths stored in environment variables.

Technologies: shescape (npm). Vendors: npm.

Quick answers

Is CVE-2025-30222 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-30222 being exploited in the wild.
How severe is CVE-2025-30222?
Medium severity, with a CVSS score of 4, published 26 March 2025.
Which products and versions are affected?
shescape (npm) SEMVER:introduced=1.7.2,fixed=2.1.2.
Is there a fix for CVE-2025-30222?
Yes. shescape (npm): upgrade to 2.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-30222 attacked?
It is attacked with local access.
Am I affected by CVE-2025-30222?
Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • shescape (npm): upgrade to 2.1.2 or later
    npm install shescape@2.1.2

Technical details

The vulnerability is an information disclosure flaw (CWE-200) in Shescape's argument escaping logic for Windows CMD.exe. When users invoke quote(), quoteAll(), escape(), or escapeAll() methods with CMD.exe as the shell, input containing the percent character (%) is not properly escaped, allowing CMD variable expansion syntax (e.g., %PATH%) to be interpreted by the shell. The attack requires the attacker to control user input passed to Shescape and the application must be configured explicitly with shell: 'cmd.exe' or shell: true on Windows. The impact is read-only access to environment variables; the patch is available in v2.1.2, with v1.x receiving no updates.

Affected products

  • Shescape Shescape 1.7.2 through 2.1.1

Identifiers

  • CVE-2025-30222
  • GHSA-66pp-5p9w-q87j

Timeline

  • 2025-03-25: disclosed
  • 2025-03-26: patched: Fixed in Shescape v2.1.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.