# CVE-2026-73413: Shescape quadratic-time denial of service in flag-protection

Source: https://junglewise.ai/threats/cve-2026-73413-shescape-quadratic-time-denial-of-service-in-flag-protection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73413 · Severity: medium · CVSS 4 · Published 2026-08-12

Shescape is a JavaScript library used to escape strings for safe use in shell commands. When flag protection is enabled (the default), the library has a performance flaw that can be exploited with specially crafted input, causing the application to become unresponsive and denying service to legitimate users.

Technologies: [shescape (npm)](https://junglewise.ai/threats/technologies/shescape). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-73413 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73413 being exploited in the wild.

**How severe is CVE-2026-73413?** Medium severity, with a CVSS score of 4, published 12 August 2026.

**Which products and versions are affected?** shescape (npm) SEMVER:introduced=2.1.11,fixed=2.1.14.

**Is there a fix for CVE-2026-73413?** Yes. shescape (npm): upgrade to 2.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73413 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73413?** Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- shescape (npm): upgrade to 2.1.14 or later

  ```sh
  npm install shescape@2.1.14
  ```


## Technical details

This is an algorithmic complexity vulnerability (CWE-407) in Shescape's flag-protection feature, which is enabled by default. An attacker can craft input containing null bytes and hyphens repeated many times (e.g., "\0-" repeated 32,000 times) to trigger quadratic-time behavior in the escape(), escapeAll(), quote(), or quoteAll() methods. The vulnerability requires no authentication and is reachable via any of the library's public APIs when processing untrusted input. An attacker can cause CPU exhaustion leading to denial of service. The vulnerability has been patched in versions 2.1.14 and 3.0.1; users of v2 should upgrade to v3 as v2 reaches end-of-life on 2026-09-28.

## Affected products

- Eric Cornelissen Shescape 2.1.11 to 2.1.13, 3.0.0

## Identifiers

- CVE-2026-73413
- GHSA-gm3r-q2wp-hw87

## Timeline

- 2026-07-24: disclosed
- 2026-07-24: patched: Patches released in v2.1.14 and v3.0.1

## References

- [https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87](https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87)
- [https://github.com/ericcornelissen/shescape/pull/2649](https://github.com/ericcornelissen/shescape/pull/2649)

## Related threats

- [Shescape shell injection via unescaped parentheses on Windows CMD](https://junglewise.ai/threats/cve-2026-73414-shescape-shell-injection-via-unescaped-parentheses-on-windows-cmd)
- [Shescape path disclosure on Unix with Zsh](https://junglewise.ai/threats/cve-2026-73412-shescape-path-disclosure-on-unix-with-zsh)
- [Shescape home-directory disclosure in Dash shell assignment](https://junglewise.ai/threats/cve-2026-73411-shescape-home-directory-disclosure-in-dash-shell-assignment)
- [Shescape escape() bracket glob expansion bypass on Bash, BusyBox, and Dash](https://junglewise.ai/threats/cve-2026-32094-shescape-escape-bracket-glob-expansion-bypass-on-bash-busybox-and)
- [Shescape shell misidentification via symlink chains](https://junglewise.ai/threats/cve-2026-30916-shescape-shell-misidentification-via-symlink-chains)