CVE-2022-25918

Regular Expression Denial of Service (ReDoS)

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.

Affected

shescape

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 SNYK

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

1.36% chance of exploitation in the next 30 days, 71st percentile

Published

2022-10-27

Updated

2025-05-05

Proof-of-concept exploits (1)

• https://security.snyk.io/vuln/SNYK-JS-SHESCAPE-3061108

Security advisories

• ericcornelissen/shescape/releases/tag/v1.6.1
• advisories/GHSA-cr84-xvw4-qx3c

References

• CVE Record
• NVD entry