What’s Vulnerable › Products

ericcornelissen shescape vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your ericcornelissen shescape version is affected

Latest ericcornelissen shescape vulnerabilities

• CVE-2026-73055 — Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox (CVSS 4.8)
• CVE-2026-73414 — Shescape: Shell injection via unescaped parentheses on Windows with CMD (CVSS 9.2)
• CVE-2026-73413 — Shescape: Quadratic-time denial of service in flag-protection (CVSS 8.7)
• CVE-2026-73412 — Shescape: Path disclosure on Unix with Zsh (CVSS 6.3)
• CVE-2026-73411 — Shescape: Home-directory disclosure in assignment context on Unix with Dash (CVSS 6.3)
• CVE-2026-32094 — Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash (CVSS 6.5)
• CVE-2025-30222 — Shescape has potential environment variable exposure on Windows with CMD (CVSS 2.1)
• CVE-2023-40185 — Shescape on Windows escaping may be bypassed in threaded context (CVSS 8.6)
• CVE-2023-35931 — Shescape potential environment variable exposure on Windows with CMD (CVSS 4.3)
• CVE-2022-25918 — Regular Expression Denial of Service (ReDoS) (CVSS 7.5)
• CVE-2022-36064 — Shescape Inefficient Regular Expression Complexity vulnerability (CVSS 7.5)
• CVE-2022-31180 — Insufficient escaping of whitespace in shescape (CVSS 9.8)
• CVE-2022-31179 — Insufficient escaping of line feeds for CMD in shescape (CVSS 9.8)
• CVE-2022-24725 — Exposure of home directory through shescape on Unix with Bash (CVSS 5.5)
• CVE-2021-21384 — Null characters not escaped in shescape (CVSS 7.8)