CyberRota Analysis
AI-GeneratedThe vulnerability affects Shescape versions prior to 2.1.14 and 3.0.1, specifically on Windows systems using cmd.exe, where improper escaping of parentheses allows for arbitrary command execution through crafted arguments. This critical flaw poses a significant risk to applications utilizing the escape or escapeAll APIs, enabling attackers to inject malicious shell syntax. Organizations using affected versions of Shescape should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An attacker-controlled argument can break out of a parenthesized CMD construct and inject shell syntax depending on the original command, resulting in arbitrary command execution. This issue is fixed in versions 2.1.14 and 3.0.1.