Executive brief
Shescape is a JavaScript library used to escape strings for safe use in shell commands. When flag protection is enabled (the default), the library has a performance flaw that can be exploited with specially crafted input, causing the application to become unresponsive and denying service to legitimate users.
Technical details
This is an algorithmic complexity vulnerability (CWE-407) in Shescape's flag-protection feature, which is enabled by default. An attacker can craft input containing null bytes and hyphens repeated many times (e.g., "\0-" repeated 32,000 times) to trigger quadratic-time behavior in the escape(), escapeAll(), quote(), or quoteAll() methods. The vulnerability requires no authentication and is reachable via any of the library's public APIs when processing untrusted input. An attacker can cause CPU exhaustion leading to denial of service. The vulnerability has been patched in versions 2.1.14 and 3.0.1; users of v2 should upgrade to v3 as v2 reaches end-of-life on 2026-09-28.
Affected products
- Eric Cornelissen Shescape 2.1.11 to 2.1.13, 3.0.0
Timeline
- 2026-07-24: disclosed
- 2026-07-24: patched: Patches released in v2.1.14 and v3.0.1