7.5

CVE-2022-25918

Exploit

Regular Expression Denial of Service (ReDoS)

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Shescape Project ≫ Shescape Version1.5.10 SwPlatformnode.js
Shescape Project ≫ Shescape Version1.6.0 SwPlatformnode.js
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.25% 0.654
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
report@snyk.io 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-1333 Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

https://github.com/ericcornelissen/shescape/blob/main/src/unix.js%23L52
Broken Link
https://github.com/ericcornelissen/shescape/commit/552e8eab56861720b1d4e5474fb65741643358f9
Patch
Third Party Advisory
https://github.com/ericcornelissen/shescape/releases/tag/v1.6.1
Third Party Advisory
Release Notes
https://security.snyk.io/vuln/SNYK-JS-SHESCAPE-3061108
Patch
Third Party Advisory
Exploit