CVE-2022-31179

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows An attacker can omit all arguments following their input by including a line feed character (`'\n'`) in the payload. This bug has been patched in [v1.5.8] which you can upgrade to now. No further changes are required. Alternatively, line feed characters (`'\n'`) can be stripped out manually or the user input can be made the last argument (this only limits the impact).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
ericcornelissen	shescape	< 1.5.8

References

https://github.com/ericcornelissen/shescape/pull/332Patch, Third Party Advisory
https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8Release Notes, Third Party Advisory
https://github.com/ericcornelissen/shescape/security/advisories/GHSA-jjc5-fp7p-6f8wExploit, Patch, Third Party Advisory
https://github.com/ericcornelissen/shescape/pull/332Patch, Third Party Advisory
https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8Release Notes, Third Party Advisory
https://github.com/ericcornelissen/shescape/security/advisories/GHSA-jjc5-fp7p-6f8wExploit, Patch, Third Party Advisory

Timeline

Published: Aug 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-31189.8A vulnerability was found in Sourcecodehero ERP System Project. It has been rated as critical. This issue affects some unknown processing of CVE-2022-311809.8Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when int CVE-2022-311819.8PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vul CVE-2022-311825.3Discourse is the an open source discussion platform. In affected versions a maliciously crafted request for static assets could cause error CVE-2022-311839.8fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the paramete CVE-2022-311847.5Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. CVE-2022-311855.3mprweb is a hosting platform for the makedeb Package Repository. Email addresses were found to not have been hidden, even if a user had clic CVE-2022-311863.3NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-aut CVE-2022-311875.4GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service D CVE-2022-311889.8CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a CVE-2022-311895.3DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component f CVE-2022-31197.5The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could a