# shescape (npm) vulnerabilities 13 known vulnerabilities (2 critical, 2 high, 7 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.0.2 (Aug 1, 2026): no advisory affects it - Newest unaffected release: 3.0.2 (Aug 1, 2026), the latest release - Weekly downloads: 26K - Dependents: 3 - Releases: 68 since 0.1.0 (Nov 6, 2020) - Registry: https://www.npmjs.com/package/shescape - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-73414: 0.1.0 to 2.1.13 (2.1.14 is outside it); 3.0.0 (3.0.1 is outside it) - CVE-2026-73413: 2.1.11 to 2.1.13 (2.1.14 is outside it); 3.0.0 (3.0.1 is outside it) - CVE-2026-73412: 0.1.0 to 2.1.13 (2.1.14 is outside it); 3.0.0 (3.0.1 is outside it) - CVE-2026-73411: 0.1.0 to 2.1.13 (2.1.14 is outside it); 3.0.0 (3.0.1 is outside it) - CVE-2026-32094: 0.1.0 to 2.1.9 (2.1.10 is outside it) - CVE-2025-30222: 1.7.2 to 2.1.1 (2.1.2 is outside it) - CVE-2023-40185: 0.1.0 to 1.7.3 (1.7.4 is outside it) - CVE-2023-35931: 0.1.0 to 1.7.0 (1.7.1 is outside it) - CVE-2022-25918: 1.5.10 to 1.6.0 (1.6.1 is outside it) - CVE-2022-31179: 0.1.0 to 1.5.7 (1.5.8 is outside it) - CVE-2022-31180: 1.4.0 to 1.5.7 (1.5.8 is outside it) - CVE-2022-24725: 1.4.0 to 1.5.0 (1.5.1 is outside it) - CVE-2021-21384: 0.1.0 to 1.1.2 (1.1.3 is outside it) ## Advisories (13) ### [CVE-2026-73414](https://cve.now/CVE-2026-73414): Shescape: Shell injection via unescaped parentheses on Windows with CMD - Severity: Critical 9.2 - Published: Aug 12, 2026 - Affected: fixed in 2.1.14; from 3.0.0, fixed in 3.0.1. - Fixed in 2.1.14 (released Jul 22, 2026, 21 days before disclosure) and 3.0.1 (released Jul 22, 2026, 21 days before disclosure). - The latest release, 3.0.2, is not affected. - 36% of shescape downloads last week were affected versions (8.9K). ### [CVE-2026-73413](https://cve.now/CVE-2026-73413): Shescape: Quadratic-time denial of service in flag-protection - Severity: High 8.7 - Published: Aug 12, 2026 - Affected: from 2.1.11, fixed in 2.1.14; from 3.0.0, fixed in 3.0.1. - Fixed in 2.1.14 (released Jul 22, 2026, 21 days before disclosure) and 3.0.1 (released Jul 22, 2026, 21 days before disclosure). - The latest release, 3.0.2, is not affected. - 1.4% of shescape downloads last week were affected versions (330). ### [CVE-2026-73412](https://cve.now/CVE-2026-73412): Shescape: Path disclosure on Unix with Zsh - Severity: Medium 6.3 - Published: Aug 12, 2026 - Affected: fixed in 2.1.14; from 3.0.0, fixed in 3.0.1. - Fixed in 2.1.14 (released Jul 22, 2026, 21 days before disclosure) and 3.0.1 (released Jul 22, 2026, 21 days before disclosure). - The latest release, 3.0.2, is not affected. - 36% of shescape downloads last week were affected versions (8.9K). ### [CVE-2026-73411](https://cve.now/CVE-2026-73411): Shescape: Home-directory disclosure in assignment context on Unix with Dash - Severity: Medium 6.3 - Published: Aug 12, 2026 - Affected: fixed in 2.1.14; from 3.0.0, fixed in 3.0.1. - Fixed in 2.1.14 (released Jul 22, 2026, 21 days before disclosure) and 3.0.1 (released Jul 22, 2026, 21 days before disclosure). - The latest release, 3.0.2, is not affected. - 36% of shescape downloads last week were affected versions (8.9K). ### [CVE-2026-32094](https://cve.now/CVE-2026-32094): Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash - Severity: Medium 6.9 - Published: Mar 11, 2026 - Affected: fixed in 2.1.10. - Fixed in 2.1.10 (released Mar 10, 2026, 1 day before disclosure). - The latest release, 3.0.2, is not affected. - 35% of shescape downloads last week were affected versions (8.5K). ### [CVE-2025-30222](https://cve.now/CVE-2025-30222): Shescape has potential environment variable exposure on Windows with CMD - Severity: Low 2.1 - Published: Mar 25, 2025 - Affected: from 1.7.2, fixed in 2.1.2. - Fixed in 2.1.2 (released Mar 25, 2025, the day of disclosure). - The latest release, 3.0.2, is not affected. - 1.9% of shescape downloads last week were affected versions (472). ### [CVE-2023-40185](https://cve.now/CVE-2023-40185): Shescape on Windows escaping may be bypassed in threaded context - Severity: Medium 6.5 - Published: Aug 23, 2023 - Affected: fixed in 1.7.4. - Fixed in 1.7.4 (released Aug 21, 2023, 2 days before disclosure). - The latest release, 3.0.2, is not affected. - 5.8% of shescape downloads last week were affected versions (1.4K). ### [CVE-2023-35931](https://cve.now/CVE-2023-35931): Shescape potential environment variable exposure on Windows with CMD - Severity: Low 3.1 - Published: Jun 23, 2023 - Affected: fixed in 1.7.1. - Fixed in 1.7.1 (released Jun 21, 2023, 2 days before disclosure). - The latest release, 3.0.2, is not affected. - 5.5% of shescape downloads last week were affected versions (1.4K). ### [CVE-2022-25918](https://cve.now/CVE-2022-25918): Regular Expression Denial of Service (ReDoS) - Severity: Medium 5.3 - Published: Oct 27, 2022 - Affected: from 1.5.10, fixed in 1.6.1. - Fixed in 1.6.1 (released Oct 25, 2022, 2 days before disclosure). - The latest release, 3.0.2, is not affected. - 0.2% of shescape downloads last week were affected versions (42). ### [CVE-2022-31179](https://cve.now/CVE-2022-31179): Insufficient escaping of line feeds for CMD in shescape - Severity: High 8.1 - Published: Aug 1, 2022 - Affected: fixed in 1.5.8. - Fixed in 1.5.8 (released Jul 15, 2022, 17 days before disclosure). - The latest release, 3.0.2, is not affected. - 2.1% of shescape downloads last week were affected versions (512). ### [CVE-2022-31180](https://cve.now/CVE-2022-31180): Insufficient escaping of whitespace in shescape - Severity: Critical 9.8 - Published: Aug 1, 2022 - Affected: from 1.4.0, fixed in 1.5.8. - Fixed in 1.5.8 (released Jul 15, 2022, 17 days before disclosure). - The latest release, 3.0.2, is not affected. - 0.8% of shescape downloads last week were affected versions (198). ### [CVE-2022-24725](https://cve.now/CVE-2022-24725): Exposure of home directory through shescape on Unix with Bash - Severity: Medium 6.2 - Published: Mar 3, 2022 - Affected: from 1.4.0, fixed in 1.5.1. - Fixed in 1.5.1 (released Feb 20, 2022, 11 days before disclosure). - The latest release, 3.0.2, is not affected. - 0.2% of shescape downloads last week were affected versions (51). ### [CVE-2021-21384](https://cve.now/CVE-2021-21384): Null characters not escaped in shescape - Severity: Medium 6.3 - Published: Mar 18, 2021 - Affected: fixed in 1.1.3. - Fixed in 1.1.3 (released Mar 13, 2021, 5 days before disclosure). - The latest release, 3.0.2, is not affected. - 0.9% of shescape downloads last week were affected versions (214). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/shescape Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.