- Latest release
- 3.0.2 (Aug 1, 2026): no advisory affects it
- Newest unaffected release
- 3.0.2 (Aug 1, 2026), the latest release
- Advisories
- 13 · 2 critical, 2 high, 7 medium, 2 low
- Weekly downloads
- 26K
- Dependents
- 3
- Releases
- 68 since 0.1.0 (Nov 6, 2020)
- Registry
- npm
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-73414Affects 0.1.0 to 2.1.13 (2.1.14 is outside it); 3.0.0 (3.0.1 is outside it)
- CVE-2026-73413Affects 2.1.11 to 2.1.13 (2.1.14 is outside it); 3.0.0 (3.0.1 is outside it)
- CVE-2026-73412Affects 0.1.0 to 2.1.13 (2.1.14 is outside it); 3.0.0 (3.0.1 is outside it)
- CVE-2026-73411Affects 0.1.0 to 2.1.13 (2.1.14 is outside it); 3.0.0 (3.0.1 is outside it)
- CVE-2026-32094Affects 0.1.0 to 2.1.9 (2.1.10 is outside it)
- CVE-2025-30222Affects 1.7.2 to 2.1.1 (2.1.2 is outside it)
- CVE-2023-40185Affects 0.1.0 to 1.7.3 (1.7.4 is outside it)
- CVE-2023-35931Affects 0.1.0 to 1.7.0 (1.7.1 is outside it)
- CVE-2022-25918Affects 1.5.10 to 1.6.0 (1.6.1 is outside it)
- CVE-2022-31179Affects 0.1.0 to 1.5.7 (1.5.8 is outside it)
- CVE-2022-31180Affects 1.4.0 to 1.5.7 (1.5.8 is outside it)
- CVE-2022-24725Affects 1.4.0 to 1.5.0 (1.5.1 is outside it)
- CVE-2021-21384Affects 0.1.0 to 1.1.2 (1.1.3 is outside it)
Advisories 13
- CVE-2026-73414Critical 9.2
Shescape: Shell injection via unescaped parentheses on Windows with CMD
Affected: fixed in 2.1.14; from 3.0.0, fixed in 3.0.1.
Fixed in 2.1.14 (released Jul 22, 2026, 21 days before disclosure) and 3.0.1 (released Jul 22, 2026, 21 days before disclosure).
The latest release, 3.0.2, is not affected.
36% of shescape downloads last week were affected versions (8.9K).
- CVE-2026-73413High 8.7
Shescape: Quadratic-time denial of service in flag-protection
Affected: from 2.1.11, fixed in 2.1.14; from 3.0.0, fixed in 3.0.1.
Fixed in 2.1.14 (released Jul 22, 2026, 21 days before disclosure) and 3.0.1 (released Jul 22, 2026, 21 days before disclosure).
The latest release, 3.0.2, is not affected.
1.4% of shescape downloads last week were affected versions (330).
- CVE-2026-73412Medium 6.3
Shescape: Path disclosure on Unix with Zsh
Affected: fixed in 2.1.14; from 3.0.0, fixed in 3.0.1.
Fixed in 2.1.14 (released Jul 22, 2026, 21 days before disclosure) and 3.0.1 (released Jul 22, 2026, 21 days before disclosure).
The latest release, 3.0.2, is not affected.
36% of shescape downloads last week were affected versions (8.9K).
- CVE-2026-73411Medium 6.3
Shescape: Home-directory disclosure in assignment context on Unix with Dash
Affected: fixed in 2.1.14; from 3.0.0, fixed in 3.0.1.
Fixed in 2.1.14 (released Jul 22, 2026, 21 days before disclosure) and 3.0.1 (released Jul 22, 2026, 21 days before disclosure).
The latest release, 3.0.2, is not affected.
36% of shescape downloads last week were affected versions (8.9K).
- CVE-2026-32094Medium 6.9
Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash
Affected: fixed in 2.1.10.
Fixed in 2.1.10 (released Mar 10, 2026, 1 day before disclosure).
The latest release, 3.0.2, is not affected.
35% of shescape downloads last week were affected versions (8.5K).
- CVE-2025-30222Low 2.1
Shescape has potential environment variable exposure on Windows with CMD
Affected: from 1.7.2, fixed in 2.1.2.
Fixed in 2.1.2 (released Mar 25, 2025, the day of disclosure).
The latest release, 3.0.2, is not affected.
1.9% of shescape downloads last week were affected versions (472).
- CVE-2023-40185Medium 6.5
Shescape on Windows escaping may be bypassed in threaded context
Affected: fixed in 1.7.4.
Fixed in 1.7.4 (released Aug 21, 2023, 2 days before disclosure).
The latest release, 3.0.2, is not affected.
5.8% of shescape downloads last week were affected versions (1.4K).
- CVE-2023-35931Low 3.1
Shescape potential environment variable exposure on Windows with CMD
Affected: fixed in 1.7.1.
Fixed in 1.7.1 (released Jun 21, 2023, 2 days before disclosure).
The latest release, 3.0.2, is not affected.
5.5% of shescape downloads last week were affected versions (1.4K).
- CVE-2022-25918Medium 5.3
Regular Expression Denial of Service (ReDoS)
Affected: from 1.5.10, fixed in 1.6.1.
Fixed in 1.6.1 (released Oct 25, 2022, 2 days before disclosure).
The latest release, 3.0.2, is not affected.
0.2% of shescape downloads last week were affected versions (42).
- CVE-2022-31179High 8.1
Insufficient escaping of line feeds for CMD in shescape
Affected: fixed in 1.5.8.
Fixed in 1.5.8 (released Jul 15, 2022, 17 days before disclosure).
The latest release, 3.0.2, is not affected.
2.1% of shescape downloads last week were affected versions (512).
- CVE-2022-31180Critical 9.8
Insufficient escaping of whitespace in shescape
Affected: from 1.4.0, fixed in 1.5.8.
Fixed in 1.5.8 (released Jul 15, 2022, 17 days before disclosure).
The latest release, 3.0.2, is not affected.
0.8% of shescape downloads last week were affected versions (198).
- CVE-2022-24725Medium 6.2
Exposure of home directory through shescape on Unix with Bash
Affected: from 1.4.0, fixed in 1.5.1.
Fixed in 1.5.1 (released Feb 20, 2022, 11 days before disclosure).
The latest release, 3.0.2, is not affected.
0.2% of shescape downloads last week were affected versions (51).
- CVE-2021-21384Medium 6.3
Null characters not escaped in shescape
Affected: fixed in 1.1.3.
Fixed in 1.1.3 (released Mar 13, 2021, 5 days before disclosure).
The latest release, 3.0.2, is not affected.
0.9% of shescape downloads last week were affected versions (214).