https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 25 Jul 2026 20:17:05 +0000 https://vulnerability.circl.lu/sighting/80064943-23f2-4f6a-b9ae-af450afce574/export {"uuid": "80064943-23f2-4f6a-b9ae-af450afce574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-W4HW-QCX7-56PR", "type": "seen", "source": "https://gist.github.com/alon710/dc8e3d82c3fbe561c037061a882b0db5", "content": "# GHSA-W4HW-QCX7-56PR: GHSA-W4HW-QCX7-56PR: OS Command Injection in Shescape via Unescaped Parentheses on Windows CMD\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-W4HW-QCX7-56PR\n\n## Summary\nA critical command injection vulnerability in the shescape npm library affects Windows systems when running shell commands using cmd.exe. The escaping function fails to neutralize parentheses, allowing attackers to close shell blocks and execute arbitrary commands.\n\n## TL;DR\nUnescaped parentheses in shescape on Windows allow attackers to bypass shell escaping and execute arbitrary OS commands when input is processed within parenthesized cmd.exe blocks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78, CWE-150\n- **Attack Vector**: Network\n- **CVSS Score**: 9.2 (Critical)\n- **EPSS Score**: N/A\n- **Impact**: Arbitrary Code Execution (RCE)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Windows systems running Node.js applications that utilize shescape to escape arguments for cmd.exe\n- **shescape**: < 2.1.14 (Fixed in: `2.1.14`)\n- **shescape**: >= 3.0.0, < 3.0.1 (Fixed in: `3.0.1`)\n\n## Mitigation\n\n- Upgrade to patched version 2.1.14 or 3.0.1.\n- Filter and reject input containing parenthesis characters if running on Windows.\n- Avoid interpolating escaped strings into parenthesized shell script constructs.\n\n**Remediation Steps:**\n1. Audit the codebase to find usages of shescape, identifying instances configured with cmd.exe or true shell.\n2. Execute 'npm install shescape@latest' or modify package.json to pin to >=2.1.14 or >=3.0.1.\n3. Verify the dependency tree and package-lock.json to ensure older versions are fully removed.\n4. Implement defensive coding practices, passing parameters as arguments rather than constructing dynamic shell commands.\n\n## References\n\n- [GitHub Advisory Database entry for GHSA-w4hw-qcx7-56pr](https://github.com/advisories/GHSA-w4hw-qcx7-56pr)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-W4HW-QCX7-56PR) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T12:32:06.469040Z"} {"uuid": "80064943-23f2-4f6a-b9ae-af450afce574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-W4HW-QCX7-56PR", "type": "seen", "source": "https://gist.github.com/alon710/dc8e3d82c3fbe561c037061a882b0db5", "content": "# GHSA-W4HW-QCX7-56PR: GHSA-W4HW-QCX7-56PR: OS Command Injection in Shescape via Unescaped Parentheses on Windows CMD\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-W4HW-QCX7-56PR\n\n## Summary\nA critical command injection vulnerability in the shescape npm library affects Windows systems when running shell commands using cmd.exe. The escaping function fails to neutralize parentheses, allowing attackers to close shell blocks and execute arbitrary commands.\n\n## TL;DR\nUnescaped parentheses in shescape on Windows allow attackers to bypass shell escaping and execute arbitrary OS commands when input is processed within parenthesized cmd.exe blocks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78, CWE-150\n- **Attack Vector**: Network\n- **CVSS Score**: 9.2 (Critical)\n- **EPSS Score**: N/A\n- **Impact**: Arbitrary Code Execution (RCE)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Windows systems running Node.js applications that utilize shescape to escape arguments for cmd.exe\n- **shescape**: < 2.1.14 (Fixed in: `2.1.14`)\n- **shescape**: >= 3.0.0, < 3.0.1 (Fixed in: `3.0.1`)\n\n## Mitigation\n\n- Upgrade to patched version 2.1.14 or 3.0.1.\n- Filter and reject input containing parenthesis characters if running on Windows.\n- Avoid interpolating escaped strings into parenthesized shell script constructs.\n\n**Remediation Steps:**\n1. Audit the codebase to find usages of shescape, identifying instances configured with cmd.exe or true shell.\n2. Execute 'npm install shescape@latest' or modify package.json to pin to >=2.1.14 or >=3.0.1.\n3. Verify the dependency tree and package-lock.json to ensure older versions are fully removed.\n4. Implement defensive coding practices, passing parameters as arguments rather than constructing dynamic shell commands.\n\n## References\n\n- [GitHub Advisory Database entry for GHSA-w4hw-qcx7-56pr](https://github.com/advisories/GHSA-w4hw-qcx7-56pr)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-W4HW-QCX7-56PR) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T12:32:06.469040Z"} https://vulnerability.circl.lu/sighting/80064943-23f2-4f6a-b9ae-af450afce574/export Sat, 25 Jul 2026 12:32:06 +0000