Inefficient Algorithmic Complexity

Overview shescape is a simple shell escape library Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the compose in src/internal/compose.js when flagProtection is enabled. An attacker can exhaust system resources and cause service disruption by supplying a...

CVE-2026-73413

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size...

Inefficient Algorithmic Complexity

Overview shescape is a simple shell escape library Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the flagProtection process. An attacker can cause significant resource exhaustion by submitting specially crafted large inputs, leading to degraded...