Vulnerability in Ericcornelissen Shescape
CVE-2023-40185
shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell. This bug has been patched in version 1.7.4.
EPSS: 0.007 (49.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L.
Affected products
- Ericcornelissen Shescape — versions < 1.7.4
- Microsoft Windows
- Shescape_project Shescape
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Patch, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2023-40185?
- CVE-2023-40185 is a medium-severity vulnerability in Ericcornelissen Shescape, classified under CWE-150. CVSS score: 6.5/10. Published 2023-08-23.
- How severe is CVE-2023-40185?
- Medium severity. CVSS v3 base score is 6.5 out of 10.