Overview

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Information Exposure due to the configuration of shell parameter. An attacker can gain read-only access to environment variables by manipulating input parameters such as quote, quoteAll, escape, or escapeAll.

Note: This is only exploitable if the attacker is a user of Shescape on Windows that explicitly configures shell: cmd.exe or shell: true using any of quote/quoteAll/escape/escapeAll.

Workaround

This vulnerability can be mitigated by removing all instances of % from user input before using Shescape.

Remediation

Upgrade shescape to version 2.1.2 or higher.

References

• GitHub Commit
• GitHub PR

MPL-2.0 license