CVE-2023-35931

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-526

Affected software

No affected versions have been published.

Timeline

Published: Jun 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-359328.8jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user in CVE-2023-359337.5OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS at CVE-2023-359348.2yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp CVE-2023-359365.0Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in ve CVE-2023-359378.8Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission che CVE-2023-359387.2Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. When switching from a project visibil CVE-2023-359398.1GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on CVE-2023-359407.5GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on CVE-2023-359419.8Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, an CVE-2023-359426.5Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, an CVE-2023-359437.5Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, an CVE-2023-359445.3Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, s