Shescape quadratic-time denial of service in flag-protection

Executive brief

Shescape is a library used to safely escape and quote shell commands to prevent injection attacks. A flaw in its flag protection feature allows an attacker to provide specially crafted, long inputs that cause the system to slow down significantly or crash. This can lead to a denial of service, making the application unavailable to legitimate users.

Technical details

A denial of service vulnerability exists in Shescape due to inefficient algorithmic complexity (CWE-407) in the flag-protection logic. When flag protection is enabled (which is the default), the library processes certain inputs in quadratic time relative to the input size. An attacker can exploit this by sending a large payload containing specific character sequences (e.g., repeated null bytes followed by hyphens) to any of the library's primary APIs like escape or quote. This results in excessive CPU consumption and application hangs. The issue is fixed in versions 2.1.14 and 3.0.1.

Affected products

• ericcornelissen shescape >= 2.1.11, < 2.1.14
• ericcornelissen shescape >= 3.0.0, < 3.0.1

Timeline

• 2026-07-23: disclosed
• 2026-07-24: advisory

References

• https://api.github.com/users/oran-s
• https://github.com/oran-s
• https://api.github.com/users/oran-s/gists%7B/gist_id%7D
• https://api.github.com/users/oran-s/repos
• https://avatars.githubusercontent.com/u/252446027?v=4
• https://api.github.com/users/oran-s/events%7B/privacy%7D