8.6

CVE-2023-40185

Exploit

Shescape on Windows escaping may be bypassed in threaded context

shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell. This bug has been patched in version 1.7.4.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Shescape Project ≫ Shescape SwPlatformnode.js Version < 1.7.4
   Microsoft ≫ Windows Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.56% 0.419
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.6 3.9 4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
security-advisories@github.com 6.5 2.2 3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

https://github.com/ericcornelissen/shescape/commit/0b976dab645abf45ffd85e74a8c6e51ee2f42d63
Patch
https://github.com/ericcornelissen/shescape/pull/1142
Patch
https://github.com/ericcornelissen/shescape/releases/tag/v1.7.4
Release Notes
https://github.com/ericcornelissen/shescape/security/advisories/GHSA-j55r-787p-m549
Patch
Vendor Advisory
Exploit