What is CVE-2022-25918?

CVE-2022-25918 is a medium-severity vulnerability in Shescape_project Shescape, classified under Inefficient Regular Expression Complexity. CVSS score: 5.3/10. Published 2022-10-27.

How severe is CVE-2022-25918?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Shescape_project Shescape

CVE-2022-25918

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.

Vulnerability class: ReDoS (Regular Expression Denial of Service)

EPSS: 0.012 (66.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Shescape_project Shescape — versions 1.5.10, 1.6.0
N/a Shescape — versions 1.5.10, unspecified

Weakness classification (CWE)

CWE-1333 — Inefficient Regular Expression Complexity

References

report@snyk.io (Exploit, Patch, Third Party Advisory)
report@snyk.io (Broken Link)
report@snyk.io (Patch, Third Party Advisory)
report@snyk.io (Third Party Advisory, Release Notes)

Frequently asked questions

What is CVE-2022-25918?: CVE-2022-25918 is a medium-severity vulnerability in Shescape_project Shescape, classified under Inefficient Regular Expression Complexity. CVSS score: 5.3/10. Published 2022-10-27.
How severe is CVE-2022-25918?: Medium severity. CVSS v3 base score is 5.3 out of 10.