{"kind": "product", "path": "vulns/npm/shescape", "name": "shescape", "product": "shescape", "ecosystem": "npm", "items": [{"id": "CVE-2026-73414", "noindex": false, "published": "2026-08-12T19:42:55.520Z", "modified": "2026-08-14T22:11:29.290Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00889, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73414", "title": "Shescape: Shell injection via unescaped parentheses on Windows with CMD", "description": "Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An attacker-controlled argument can break out of a parenthesized CMD construct and inject shell syntax depending on the original command, resulting in arbitrary command execution. This issue is fixed in versions 2.1.14 and 3.0.1.", "references": ["https://github.com/ericcornelissen/shescape/security/advisories/GHSA-w4hw-qcx7-56pr", "https://github.com/ericcornelissen/shescape/pull/2649", "https://github.com/ericcornelissen/shescape/pull/2651"], "fixes": ["2.1.14", "3.0.1"], "products": [{"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}, {"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}]}, {"id": "CVE-2026-73413", "noindex": false, "published": "2026-08-12T19:40:46.046Z", "modified": "2026-08-13T14:18:12.252Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0059, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73413", "title": "Shescape: Quadratic-time denial of service in flag-protection", "description": "Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1.", "references": ["https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87", "https://github.com/ericcornelissen/shescape/pull/2649", "https://github.com/ericcornelissen/shescape/pull/2651"], "fixes": ["2.1.14", "3.0.1"], "products": [{"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}, {"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}]}, {"id": "CVE-2026-73412", "noindex": false, "published": "2026-08-12T19:38:41.860Z", "modified": "2026-08-13T12:38:03.573Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00612, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73412", "title": "Shescape: Path disclosure on Unix with Zsh", "description": "Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used to leak more information. This issue is fixed in versions 2.1.14 and 3.0.1.", "references": ["https://github.com/ericcornelissen/shescape/security/advisories/GHSA-6v4m-fw66-8r4x", "https://github.com/ericcornelissen/shescape/pull/2649", "https://github.com/ericcornelissen/shescape/pull/2651"], "fixes": ["2.1.14", "3.0.1"], "products": [{"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}, {"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}]}, {"id": "CVE-2026-73411", "noindex": false, "published": "2026-08-12T19:33:02.860Z", "modified": "2026-08-12T20:54:38.353Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0059, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-73411", "title": "Shescape: Home-directory disclosure in assignment context on Unix with Dash", "description": "Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, and interpolate the result into an assignment prefixed to a command. An attacker who controls the input can supply a value such as :~ to disclose the home-directory path and may change the location on which the command operates. This issue is fixed in versions 2.1.14 and 3.0.1.", "references": ["https://github.com/ericcornelissen/shescape/security/advisories/GHSA-q53c-4prm-w95q", "https://github.com/ericcornelissen/shescape/pull/2649", "https://github.com/ericcornelissen/shescape/pull/2651"], "fixes": ["2.1.14", "3.0.1"], "products": [{"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}, {"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}]}, {"id": "CVE-2026-32094", "noindex": false, "published": "2026-03-11T19:50:10.617Z", "modified": "2026-03-12T19:54:17.725Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00227, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-32094", "title": "Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash", "description": "Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-bracket glob syntax for Bash, BusyBox sh, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like secret[12] to expand into multiple filesystem matches instead of a single literal argument, turning one argument into multiple trusted-pathname matches. This vulnerability is fixed in 2.1.10.", "references": ["https://github.com/ericcornelissen/shescape/security/advisories/GHSA-9jfh-9xrq-4vwm", "https://github.com/ericcornelissen/shescape/commit/6add105c6f6b508662bb5ae3b3bdd4c9bcebf37a", "https://nvd.nist.gov/vuln/detail/CVE-2026-32094"], "fixes": ["2.1.10"], "products": [{"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}]}, {"id": "CVE-2025-30222", "noindex": false, "published": "2025-03-25T23:00:08.995Z", "modified": "2025-03-26T13:30:34.363Z", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "severity": "low", "epss": 0.00193, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-30222", "title": "Shescape has potential environment variable exposure on Windows with CMD", "description": "Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure `shell: 'cmd.exe'` or `shell: true` using any of `quote`/`quoteAll`/`escape`/`escapeAll`. An attacker may be able to get read-only access to environment variables. This bug has been patched in v2.1.2. For those who are already using v2 of Shescape, no further changes are required. Those who are are using v1 of Shescape should follow the migration guide to upgrade to v2. There is no plan to release a patch compatib", "references": ["https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j", "https://github.com/ericcornelissen/shescape/pull/1916", "https://github.com/ericcornelissen/shescape/commit/0a81f1eb077bab8caae283a2490cd7be9af179c6"], "fixes": ["2.1.2"], "products": [{"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}]}, {"id": "CVE-2023-40185", "noindex": false, "published": "2023-08-23T20:20:45.807Z", "modified": "2024-09-30T19:14:01.973Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "severity": "medium", "epss": 0.00675, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2023-40185", "title": "Shescape on Windows escaping may be bypassed in threaded context", "description": "shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell. This bug has been patched in version 1.7.4.", "references": ["https://github.com/ericcornelissen/shescape/security/advisories/GHSA-j55r-787p-m549", "https://github.com/ericcornelissen/shescape/pull/1142", "https://github.com/ericcornelissen/shescape/commit/0b976dab645abf45ffd85e74a8c6e51ee2f42d63"], "fixes": ["1.7.4"], "products": [{"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}]}, {"id": "CVE-2023-35931", "noindex": false, "published": "2023-06-23T19:32:53.897Z", "modified": "2024-12-05T16:09:33.483Z", "cvss": 3.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00811, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2023-35931", "title": "Shescape potential environment variable exposure on Windows with CMD", "description": "Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1.\n\n\n", "references": ["https://github.com/ericcornelissen/shescape/security/advisories/GHSA-3g7p-8qhx-mc8r", "https://github.com/ericcornelissen/shescape/pull/982", "https://github.com/ericcornelissen/shescape/commit/d0fce70f987ac0d8331f93cb45d47e79436173ac"], "fixes": ["1.7.1"], "products": [{"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}]}, {"id": "CVE-2022-25918", "noindex": false, "published": "2022-10-27T05:05:09.944Z", "modified": "2025-05-05T18:24:44.572Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.01629, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2022-25918", "title": "Regular Expression Denial of Service (ReDoS)", "description": "The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.", "references": ["https://security.snyk.io/vuln/SNYK-JS-SHESCAPE-3061108", "https://github.com/ericcornelissen/shescape/blob/main/src/unix.js%23L52", "https://github.com/ericcornelissen/shescape/commit/552e8eab56861720b1d4e5474fb65741643358f9"], "fixes": ["1.6.1"], "products": [{"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}]}, {"id": "CVE-2022-31179", "noindex": false, "published": "2022-08-01T19:20:18.000Z", "modified": "2025-04-22T17:46:08.799Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H", "severity": "high", "epss": 0.01424, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2022-31179", "title": "Insufficient escaping of line feeds for CMD in shescape", "description": "Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows An attacker can omit all arguments following their input by including a line feed character (`'\\n'`) in the payload. This bug has been patched in [v1.5.8] which you can upgrade to now. No further changes are required. Alternatively, line feed characters (`'\\n'`) can be stripped out manually or the user input can be made the last argument (this only limits the impact).", "references": ["https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8", "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-jjc5-fp7p-6f8w", "https://github.com/ericcornelissen/shescape/pull/332"], "fixes": ["1.5.8"], "products": [{"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}]}, {"id": "CVE-2022-31180", "noindex": false, "published": "2022-08-01T19:15:16.000Z", "modified": "2025-04-22T17:46:22.040Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.01993, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2022-31180", "title": "Insufficient escaping of whitespace in shescape", "description": "Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. The result is that if an attacker is able to include whitespace in their input they can: 1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace. 2. Invoke shell-specific behaviour through shell-specific special characters inserted or appearing after line terminating characters. 3. Invoke arbitrary commands by", "references": ["https://github.com/ericcornelissen/shescape/security/advisories/GHSA-44vr-rwwj-p88h", "https://github.com/ericcornelissen/shescape/pull/322", "https://github.com/ericcornelissen/shescape/pull/324"], "fixes": ["1.5.8"], "products": [{"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}]}, {"id": "CVE-2022-24725", "noindex": false, "published": "2022-03-03T21:35:10.000Z", "modified": "2025-04-22T18:20:38.968Z", "cvss": 6.2, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00499, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2022-24725", "title": "Exposure of home directory through shescape on Unix with Bash", "description": "Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `interpolation` option set to `true`. Other tested shells, Dash and Zsh, are not affected. Depending on how the output of _shescape_ is used, directory traversal may be possible in the application using _shescape_. The issue was patched in version 1.5.1. As a workaround, manually escape all instances of the tilde character (`~`) using `arg.replace(/~/g, \"\\\\~\")`.", "references": ["https://github.com/ericcornelissen/shescape/security/advisories/GHSA-446w-rrm4-r47f", "https://github.com/ericcornelissen/shescape/issues/169", "https://github.com/ericcornelissen/shescape/pull/170"], "fixes": ["1.5.1"], "products": [{"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}]}, {"id": "CVE-2021-21384", "noindex": false, "published": "2021-03-18T23:50:13.000Z", "modified": "2024-08-03T18:09:15.790Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N", "severity": "medium", "epss": 0.00578, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2021-21384", "title": "Null characters not escaped in shescape", "description": "shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.", "references": ["https://github.com/ericcornelissen/shescape/security/advisories/GHSA-f2rp-38vg-j3gh", "https://github.com/ericcornelissen/shescape/commit/07a069a66423809cbedd61d980c11ca44a29ea2b", "https://github.com/ericcornelissen/shescape/releases/tag/v1.1.3"], "fixes": ["1.1.3"], "products": [{"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}]}], "total": 13, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "shescape", "path": "vulns/npm/shescape", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-08-14T22:11:29.290Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}