p PatchFirst

CVE-2026-73413

CVE-2026-73413 · Shescape: Quadratic-time denial of service in flag-protection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1.

CVSS 8.7 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • shescape

    Versions
    • >= 2.1.11, < 2.1.14: Affected
    • >= 3.0.0, < 3.0.1: Affected

    No fix published

  • shescape npm

    Affected ranges
    • SEMVER: ≥ 2.1.11, < 2.1.14

    Update to 2.1.14

  • shescape npm

    Affected ranges
    • SEMVER: ≥ 3.0.0, < 3.0.1

    Update to 3.0.1

Original sources

Check your server →