7.5

CVE-2022-25918

Exploit

Regular Expression Denial of Service (ReDoS)

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Shescape Project ≫ Shescape Version1.5.10 SwPlatformnode.js
Shescape Project ≫ Shescape Version1.6.0 SwPlatformnode.js
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.28% 0.673
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Snyk 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-1333 Inefficient Regular Expression Complexity

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

https://github.com/ericcornelissen/shescape/blob/main/src/unix.js%23L52
Broken Link
https://github.com/ericcornelissen/shescape/commit/552e8eab56861720b1d4e5474fb65741643358f9
Patch
Third Party Advisory
https://github.com/ericcornelissen/shescape/releases/tag/v1.6.1
Third Party Advisory
Release Notes
https://security.snyk.io/vuln/SNYK-JS-SHESCAPE-3061108
Patch
Third Party Advisory
Exploit