# CVE-2025-30222: Shescape environment variable exposure on Windows with CMD

Source: https://junglewise.ai/threats/cve-2025-30222-shescape-environment-variable-exposure-on-windows-with-cmd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-03-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-30222 · Severity: medium · CVSS 4 · Published 2025-03-26

Shescape is a Node.js library that safely escapes command-line arguments for shell execution. On Windows systems using CMD.exe, the library fails to properly filter percent signs (%) in user input, allowing attackers to read environment variables through CMD's variable expansion syntax. This could expose sensitive information like API keys or system paths stored in environment variables.

Technologies: [shescape (npm)](https://junglewise.ai/threats/technologies/shescape). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-30222 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-30222 being exploited in the wild.

**How severe is CVE-2025-30222?** Medium severity, with a CVSS score of 4, published 26 March 2025.

**Which products and versions are affected?** shescape (npm) SEMVER:introduced=1.7.2,fixed=2.1.2.

**Is there a fix for CVE-2025-30222?** Yes. shescape (npm): upgrade to 2.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-30222 attacked?** It is attacked with local access.

**Am I affected by CVE-2025-30222?** Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- shescape (npm): upgrade to 2.1.2 or later

  ```sh
  npm install shescape@2.1.2
  ```


## Technical details

The vulnerability is an information disclosure flaw (CWE-200) in Shescape's argument escaping logic for Windows CMD.exe. When users invoke quote(), quoteAll(), escape(), or escapeAll() methods with CMD.exe as the shell, input containing the percent character (%) is not properly escaped, allowing CMD variable expansion syntax (e.g., %PATH%) to be interpreted by the shell. The attack requires the attacker to control user input passed to Shescape and the application must be configured explicitly with shell: 'cmd.exe' or shell: true on Windows. The impact is read-only access to environment variables; the patch is available in v2.1.2, with v1.x receiving no updates.

## Affected products

- Shescape Shescape 1.7.2 through 2.1.1

## Identifiers

- CVE-2025-30222
- GHSA-66pp-5p9w-q87j

## Timeline

- 2025-03-25: disclosed
- 2025-03-26: patched: Fixed in Shescape v2.1.2

## References

- [https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j](https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j)

## Related threats

- [Shescape shell injection via unescaped parentheses on Windows CMD](https://junglewise.ai/threats/cve-2026-73414-shescape-shell-injection-via-unescaped-parentheses-on-windows-cmd)
- [Shescape quadratic-time denial of service in flag-protection](https://junglewise.ai/threats/cve-2026-73413-shescape-quadratic-time-denial-of-service-in-flag-protection)
- [Shescape path disclosure on Unix with Zsh](https://junglewise.ai/threats/cve-2026-73412-shescape-path-disclosure-on-unix-with-zsh)
- [Shescape home-directory disclosure in Dash shell assignment](https://junglewise.ai/threats/cve-2026-73411-shescape-home-directory-disclosure-in-dash-shell-assignment)
- [Shescape escape() bracket glob expansion bypass on Bash, BusyBox, and Dash](https://junglewise.ai/threats/cve-2026-32094-shescape-escape-bracket-glob-expansion-bypass-on-bash-busybox-and)