The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.
References
| Link | Resource |
|---|---|
| https://github.com/ericcornelissen/shescape/blob/main/src/unix.js%23L52 | Broken Link |
| https://github.com/ericcornelissen/shescape/commit/552e8eab56861720b1d4e5474fb65741643358f9 | Patch Third Party Advisory |
| https://github.com/ericcornelissen/shescape/releases/tag/v1.6.1 | Release Notes Third Party Advisory |
| https://security.snyk.io/vuln/SNYK-JS-SHESCAPE-3061108 | Exploit Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
08 Aug 2023, 14:22
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-1333 |
28 Oct 2022, 19:41
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | NVD-CWE-Other | |
| CPE | cpe:2.3:a:shescape_project:shescape:1.6.0:*:*:*:*:node.js:*:* cpe:2.3:a:shescape_project:shescape:1.5.10:*:*:*:*:node.js:*:* |
|
| References | (MISC) https://github.com/ericcornelissen/shescape/blob/main/src/unix.js%23L52 - Broken Link | |
| References | (MISC) https://github.com/ericcornelissen/shescape/releases/tag/v1.6.1 - Release Notes, Third Party Advisory | |
| References | (MISC) https://github.com/ericcornelissen/shescape/commit/552e8eab56861720b1d4e5474fb65741643358f9 - Patch, Third Party Advisory | |
| References | (MISC) https://security.snyk.io/vuln/SNYK-JS-SHESCAPE-3061108 - Exploit, Patch, Third Party Advisory |
27 Oct 2022, 11:28
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-27 10:15
Updated : 2024-02-04 22:51
NVD link : CVE-2022-25918
Mitre link : CVE-2022-25918
CVE.ORG link : CVE-2022-25918
JSON object : View
Products Affected
shescape_project
- shescape
CWE
CWE-1333
Inefficient Regular Expression Complexity