p PatchFirst

CVE-2022-25918

CVE-2022-25918 · Regular Expression Denial of Service (ReDoS)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.

CVSS 5.3 · Medium · EPSS 1.6% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • shescape

    Versions
    • ≥ 1.5.10, < unspecified: Affected (custom)
    • ≥ unspecified, < 1.6.1: Affected (custom)

    Update to 1.6.1

  • shescape npm

    Affected ranges
    • SEMVER: ≥ 1.5.10, < 1.6.1

    Update to 1.6.1

Original sources

Check your server →