Information Disclosure

2023-06-2305:31:00

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

shescape

information disclosure

escapeargforinterpolation function

cmd.js

sensitive environment variables

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

30.2%

JSON

shescape is vulnerable to Information Disclosure. The vulnerability exists in the escapeArgForInterpolation function at cmd.js because the command string is not properly sanitized which allows an attacker to gain access to potentially sensitive environment variables.