What’s Vulnerable › Vulnerabilities

CVE-2026-73413: Shescape: Quadratic-time denial of service in flag-protection

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-12 · updated 2026-10-24
• Weakness: CWE-400

Description

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1.

Affected products

• ericcornelissen shescape: from 2.1.11, < 2.1.14; from 3.0.0, < 3.0.1

References

• https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de
• https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f
• https://github.com/ericcornelissen/shescape/pull/2649
• https://github.com/ericcornelissen/shescape/pull/2651
• https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14
• https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1
• https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87

Get alerted when CVE-2026-73413 or the next vulnerability affects your stack