Executive brief
Shescape is a Node.js library that safely escapes command-line arguments for shell execution. On Windows systems using CMD.exe, the library fails to properly filter percent signs (%) in user input, allowing attackers to read environment variables through CMD's variable expansion syntax. This could expose sensitive information like API keys or system paths stored in environment variables.
Technical details
The vulnerability is an information disclosure flaw (CWE-200) in Shescape's argument escaping logic for Windows CMD.exe. When users invoke quote(), quoteAll(), escape(), or escapeAll() methods with CMD.exe as the shell, input containing the percent character (%) is not properly escaped, allowing CMD variable expansion syntax (e.g., %PATH%) to be interpreted by the shell. The attack requires the attacker to control user input passed to Shescape and the application must be configured explicitly with shell: 'cmd.exe' or shell: true on Windows. The impact is read-only access to environment variables; the patch is available in v2.1.2, with v1.x receiving no updates.
Affected products
- Shescape Shescape 1.7.2 through 2.1.1
Timeline
- 2025-03-25: disclosed
- 2025-03-26: patched: Fixed in Shescape v2.1.2