https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 29 Jul 2026 21:36:57 +0000 https://vulnerability.circl.lu/sighting/63514e09-0700-4d0d-a267-40ee145ce43e/export {"uuid": "63514e09-0700-4d0d-a267-40ee145ce43e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-gm3r-q2wp-hw87", "type": "seen", "source": "https://gist.github.com/alon710/8ae8c0df3840a4fc9ad0abc329a9ce1f", "content": "# GHSA-GM3R-Q2WP-HW87: GHSA-gm3r-q2wp-hw87: Quadratic-Time Denial of Service via Flag-Protection in Shescape\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-GM3R-Q2WP-HW87\n\n## Summary\nA high-severity algorithmic-complexity vulnerability in the Node.js library Shescape leads to a Quadratic-Time Denial of Service (DoS) when flag protection is enabled. By supplying inputs containing repetitive control characters and hyphens, remote attackers can trigger an inefficient nested loop in Shescape's argument-composition logic, blocking the Node.js single-threaded event loop and causing total application Denial of Service.\n\n## TL;DR\nShescape is vulnerable to an O(N^2) algorithmic complexity Denial of Service due to nested array copying and string joining inside its default flag-protection processing loop.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407 / CWE-400\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.7 (High)\n- **Exploit Status**: PoC Available\n- **Remediation**: Upgrade to v2.1.14 or v3.0.1\n- **Impact**: Application Denial of Service (CPU Exhaustion)\n\n## Affected Systems\n\n- Node.js applications utilizing shescape for command-argument escaping\n- **shescape**: >= 2.1.11, < 2.1.14 (Fixed in: `2.1.14`)\n- **shescape**: >= 3.0.0, < 3.0.1 (Fixed in: `3.0.1`)\n\n## Mitigation\n\n- Upgrade Shescape to a patched version (v3.0.1 or v2.1.14)\n- Implement strict input length validation boundaries\n- Disable the flag-protection feature if not strictly required\n\n**Remediation Steps:**\n1. Run 'npm install shescape@^3.0.1' or 'npm install shescape@^2.1.14' in your project root.\n2. Verify the installation of the patched version using npm list shescape.\n3. If updating is blocked, implement input validation checking that limits string inputs to less than 256 characters before passing them to shescape.\n\n## References\n\n- [GitHub Security Advisory GHSA-gm3r-q2wp-hw87](https://github.com/advisories/GHSA-gm3r-q2wp-hw87)\n- [Shescape Security Advisory Page](https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87)\n- [Git Fix Commit (v3)](https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de)\n- [Git Fix Commit (v2)](https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f)\n- [Release Information (v2.1.14)](https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14)\n- [Release Information (v3.0.1)](https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1)\n- [Shescape Migration Guide](https://github.com/ericcornelissen/shescape/blob/dea8893a5877893d8d4923dbf253080e08899e6d/docs/migration.md)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-GM3R-Q2WP-HW87) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T10:31:26.603280Z"} {"uuid": "63514e09-0700-4d0d-a267-40ee145ce43e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-gm3r-q2wp-hw87", "type": "seen", "source": "https://gist.github.com/alon710/8ae8c0df3840a4fc9ad0abc329a9ce1f", "content": "# GHSA-GM3R-Q2WP-HW87: GHSA-gm3r-q2wp-hw87: Quadratic-Time Denial of Service via Flag-Protection in Shescape\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-GM3R-Q2WP-HW87\n\n## Summary\nA high-severity algorithmic-complexity vulnerability in the Node.js library Shescape leads to a Quadratic-Time Denial of Service (DoS) when flag protection is enabled. By supplying inputs containing repetitive control characters and hyphens, remote attackers can trigger an inefficient nested loop in Shescape's argument-composition logic, blocking the Node.js single-threaded event loop and causing total application Denial of Service.\n\n## TL;DR\nShescape is vulnerable to an O(N^2) algorithmic complexity Denial of Service due to nested array copying and string joining inside its default flag-protection processing loop.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407 / CWE-400\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.7 (High)\n- **Exploit Status**: PoC Available\n- **Remediation**: Upgrade to v2.1.14 or v3.0.1\n- **Impact**: Application Denial of Service (CPU Exhaustion)\n\n## Affected Systems\n\n- Node.js applications utilizing shescape for command-argument escaping\n- **shescape**: >= 2.1.11, < 2.1.14 (Fixed in: `2.1.14`)\n- **shescape**: >= 3.0.0, < 3.0.1 (Fixed in: `3.0.1`)\n\n## Mitigation\n\n- Upgrade Shescape to a patched version (v3.0.1 or v2.1.14)\n- Implement strict input length validation boundaries\n- Disable the flag-protection feature if not strictly required\n\n**Remediation Steps:**\n1. Run 'npm install shescape@^3.0.1' or 'npm install shescape@^2.1.14' in your project root.\n2. Verify the installation of the patched version using npm list shescape.\n3. If updating is blocked, implement input validation checking that limits string inputs to less than 256 characters before passing them to shescape.\n\n## References\n\n- [GitHub Security Advisory GHSA-gm3r-q2wp-hw87](https://github.com/advisories/GHSA-gm3r-q2wp-hw87)\n- [Shescape Security Advisory Page](https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87)\n- [Git Fix Commit (v3)](https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de)\n- [Git Fix Commit (v2)](https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f)\n- [Release Information (v2.1.14)](https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14)\n- [Release Information (v3.0.1)](https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1)\n- [Shescape Migration Guide](https://github.com/ericcornelissen/shescape/blob/dea8893a5877893d8d4923dbf253080e08899e6d/docs/migration.md)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-GM3R-Q2WP-HW87) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T10:31:26.603280Z"} https://vulnerability.circl.lu/sighting/63514e09-0700-4d0d-a267-40ee145ce43e/export Sat, 25 Jul 2026 10:31:26 +0000