Description

Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1.

Remediation

References

https://github.com/ericcornelissen/shescape/commit/d0fce70f987ac0d8331f93cb45d47e79436173ac

https://github.com/ericcornelissen/shescape/pull/982

https://github.com/ericcornelissen/shescape/releases/tag/v1.7.1

https://github.com/ericcornelissen/shescape/security/advisories/GHSA-3g7p-8qhx-mc8r

Related Vulnerabilities

CVE-2020-9480 Vulnerability in maven package org.apache.spark:spark-network-common_2.11

CVE-2023-45135 Vulnerability in maven package org.xwiki.platform:xwiki-platform-flamingo-skin-resources

CVE-2021-31684 Vulnerability in maven package net.minidev:json-smart

CVE-2018-14732 Vulnerability in maven package org.webjars.npm:webpack-dev-server

CVE-2023-25571 Vulnerability in npm package @backstage/core-components

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Patch Release Notes Exploit Vendor Advisory NVD-CWE-noinfo