CVE-2026-73413

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size...

CVE-2026-73413 Shescape: Quadratic-time denial of service in flag-protection

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size...

CVE-2026-73413

Shescape (JavaScript library) contains a quadratic-time denial-of-service vulnerability in the flag-protection path. From versions 2.1.11 through 2.1.14 and 3.0.1, the flag-protection loop in compose.js repeatedly joins and slices flag fragments when flagProtection is enabled (default), causing p...

Shescape: Quadratic-time denial of service in the flag-protection

Impact This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the API being used. An attacker can cause a runtime quadratic in the input size, causing denial of service for large inputs. javascript import Shescape from "shescape"; // 1. Prerequisit...

GHSA-GM3R-Q2WP-HW87 Shescape: Quadratic-time denial of service in the flag-protection

Impact This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the API being used. An attacker can cause a runtime quadratic in the input size, causing denial of service for large inputs. javascript import Shescape from "shescape"; // 1. Prerequisit...