Find, fix and prevent vulnerabilities in your code.

Overview

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the escape function. An attacker can cause unintended expansion of shell arguments by supplying input containing square brackets, which may result in multiple filesystem matches being processed instead of a single literal argument. This can lead to changes in command behavior, targeting of unintended files, or exposure of filenames when the output is used in shell commands.

PoC

tmp=$(mktemp -d)
cd "$tmp"
npm pack shescape@2.1.9 >/dev/null
mkdir pkg
tar -xzf shescape-2.1.9.tgz -C pkg
cd pkg/package
npm install --omit=dev

node --input-type=module - <<'NODE'
import { mkdtempSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import path from "node:path";
import { execSync } from "node:child_process";
import { Shescape } from "./src/index.js";

const dir = mkdtempSync(path.join(tmpdir(), "shescape-ghsa-poc-"));
writeFileSync(path.join(dir, "secret1"), "");
writeFileSync(path.join(dir, "secret2"), "");

for (const shell of ["/usr/bin/bash", "/usr/bin/dash"]) {
  const shescape = new Shescape({ shell });
  const escaped = shescape.escape("secret[12]");
  console.log(${shell} escaped=${escaped});
  const out = execSync(printf '<%s>\\n' ${escaped}, { cwd: dir, shell }).toString();
  process.stdout.write(out);
}
NODE

Remediation

Upgrade shescape to version 2.1.10 or higher.

References

• GitHub Commit

Overview

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Command Injection in the escape and escapeAll functions when used on Unix systems with the shell explicitly configured to Zsh, or when the default shell is Zsh. An attacker can obtain lists of files and directories on the system by leveraging home directory expansion and extended glob syntax.

Note: This is only exploitable if the shell is set to Zsh and the Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST are enabled.

Remediation

Upgrade shescape to version 2.1.14, 3.0.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR

Overview

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the escape or escapeAll process when used with the shell option set to Dash or when the default shell is Dash. An attacker can obtain the user's home directory and potentially influence the location on which a command operates by supplying specially crafted input containing ~ characters. This is only exploitable if the application explicitly configures the shell option to Dash or relies on Dash as the default shell in assignment contexts.

Workaround

This vulnerability can be mitigated by refraining from using Dash, using the env option of the node:child_process API to inject variables with untrusted values, or removing all instances of ~ from untrusted inputs.

Remediation

Upgrade shescape to version 2.1.14, 3.0.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release
• GitHub Release

Overview

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the getEscapeFunction logic in src/internal/unix/busybox.js. An attacker can reveal the user's home directory and alter how a command interprets an assignment-prefixed value by supplying input such as :~ or a=~ to escape or escapeAll when Unix shell escaping targets BusyBox sh. On affected Unix systems where shell is set to "sh" or true and /bin/sh points to BusyBox, the escaped tilde is expanded in assignment contexts instead of being treated as data, causing commands like V=...; echo $V to print : followed by the home path.

Remediation

Upgrade shescape to version 2.1.15, 3.0.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Pull Request
• GitHub Pull Request
• Maintainer's Advisory

Overview

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Improper Neutralization in the escape or escapeAll process when used with Zsh as the shell, especially if the Zsh options EXTENDED_GLOB or MAGIC_EQUAL_SUBST are enabled. An attacker can obtain sensitive information about files and directories by supplying crafted input that leverages home directory expansion or extended glob syntax. This is only exploitable if the application is configured to use Zsh as the shell and the relevant Zsh options are enabled.

Workaround

This vulnerability can be mitigated by refraining from using Zsh, disabling the EXTENDED_GLOB option, or removing all instances of ^, #, and ~ from untrusted inputs.

Remediation

Upgrade shescape to version 2.1.14, 3.0.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release
• GitHub Release

MPL-2.0 license