Homepage
About Snyk

shescape@1.6.1 vulnerabilities

simple shell escape library

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the shescape package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Improper Neutralization

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Improper Neutralization due to possible escaping the wrong shell, thus allowing attackers to bypass protections. Note: you are only vulnerable if you are using this package on Windows in a threaded context.

How to fix Improper Neutralization?

Upgrade shescape to version 1.7.4 or higher.

<1.7.4
  • M
Information Exposure

shescape is a simple shell escape library

Affected versions of this package are vulnerable to Information Exposure such that an attacker may be able to get read-only access to environment variables.

Note:

This impact users of Shescape:

  1. On Windows using the Windows Command Prompt (i.e. cmd.exe), and
  2. Using quote/quoteAll or escape/escapeAll with the interpolation option set to true.

How to fix Information Exposure?

Upgrade shescape to version 1.7.1 or higher.

<1.7.1
Go back to all versions of this package