Описание
shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell. This bug has been patched in version 1.7.4.
Ссылки
- Patch
- Patch
- Release Notes
- ExploitPatchVendor Advisory
- Patch
- Patch
- Release Notes
- ExploitPatchVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.7.4 (исключая)
Одновременно
cpe:2.3:a:shescape_project:shescape:*:*:*:*:*:node.js:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
EPSS
Процентиль: 24%
0.00084
Низкий
6.5 Medium
CVSS3
8.6 High
CVSS3
Дефекты
CWE-150
Связанные уязвимости
CVSS3: 8.6
github
больше 2 лет назад
Shescape on Windows escaping may be bypassed in threaded context
EPSS
Процентиль: 24%
0.00084
Низкий
6.5 Medium
CVSS3
8.6 High
CVSS3
Дефекты
CWE-150