Eric Cornelissen

7 exploits Active since Oct 2020
CVE-2026-32094 WRITEUP MEDIUM WRITEUP
Shescape <2.1.10 - Command Injection
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-bracket glob syntax for Bash, BusyBox sh, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like secret[12] to expand into multiple filesystem matches instead of a single literal argument, turning one argument into multiple trusted-pathname matches. This vulnerability is fixed in 2.1.10.
CVSS 6.5
CVE-2020-15272 WRITEUP HIGH WRITEUP
git-tag-annotation-action <1.0.1 - Command Injection
In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if they can control the value of [the `tag` input] or manage to alter the value of [the `GITHUB_REF` environment variable]. The problem has been patched in version 1.0.1. If you don't use the `tag` input you are most likely safe. The `GITHUB_REF` environment variable is protected by the GitHub Actions environment so attacks from there should be impossible. If you must use the `tag` input and cannot upgrade to `> 1.0.0` make sure that the value is not controlled by another Action.
CVSS 8.7
CVE-2021-21384 WRITEUP MEDIUM WRITEUP
shescape < 1.1.3 - Command Injection via Newline Character
shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.
CVSS 6.3
CVE-2022-25918 WRITEUP MEDIUM WRITEUP
shescape >=1.5.10 <1.6.1 - Regular Expression Denial of Service via escapeArgBash Function
The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.
CVSS 5.3
CVE-2023-35931 WRITEUP LOW WRITEUP
shescape < 1.7.1 - Cleartext Storage of Sensitive Information in Environment Variable
Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1.
CVSS 3.1
CVE-2023-40185 WRITEUP MEDIUM WRITEUP
Shescape <1.7.4 - Privilege Escalation
shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell. This bug has been patched in version 1.7.4.
CVSS 6.5
CVE-2025-30222 WRITEUP LOW WRITEUP
shescape 1.7.2-2.1.1 - Environment Variable Exposure on Windows via CMD Shell
Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure `shell: 'cmd.exe'` or `shell: true` using any of `quote`/`quoteAll`/`escape`/`escapeAll`. An attacker may be able to get read-only access to environment variables. This bug has been patched in v2.1.2. For those who are already using v2 of Shescape, no further changes are required. Those who are are using v1 of Shescape should follow the migration guide to upgrade to v2. There is no plan to release a patch compatible with v1 of Shescape. As a workaround, users can remove all instances of `%` from user input before using Shescape.