CyberRota Analysis
AI-GeneratedThe vulnerability affects the Shescape library for JavaScript, specifically versions 2.1.11 to 2.1.14 and 3.0.1, where a flaw in the flag-protection loop can lead to excessive CPU consumption when processing large untrusted inputs. This can result in a denial of service, impacting applications that rely on this library. Developers and organizations using affected versions should prioritize upgrading to versions 2.1.14 or 3.0.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1.