Symlink Attack

Overview shescape is a simple shell escape library Affected versions of this package are vulnerable to Symlink Attack in resolving shells in unix.js. An attacker can expose sensitive information by configuring the shell path as a symbolic link to another symlink, which may bypass proper escaping ...

Regular Expression Denial Of Service (ReDoS)

shescape is vulnerable to denial of service. The vulnerability is due to insecure regex in the escapeArgBash function of unix.js which allows an attacker to crash the application by providing a malicious user input...

Regular Expression Denial Of Service (ReDoS)

shescape is vulnerable to regular expression denial of service. The vulnerability exists in escapeArgBash function in unix.js due to insufficient regular expression complexity in bash escaping which allows an attacker to cause polynomial backtracking or quadratic runtime resulting an application...