LOW3.1npm
GHSA-3g7p-8qhx-mc8r· CVE-2023-35931Shescape potential environment variable exposure on Windows with CMD
Modified: 9/10/2026
package
npm/shescape
pkg:npm/shescape
MEDIUM5.5npm
GHSA-446w-rrm4-r47f· CVE-2022-24725Exposure of home directory through shescape on Unix with Bash
Modified: 11/8/2023
CRITICAL9.8npm
GHSA-44vr-rwwj-p88h· CVE-2022-31180Shescape vulnerable to insufficient escaping of whitespace
Modified: 11/8/2023
LOWnpm
GHSA-66pp-5p9w-q87j· CVE-2025-30222Shescape has potential environment variable exposure on Windows with CMD
Modified: 9/10/2026
MEDIUMnpm
GHSA-6v4m-fw66-8r4x· CVE-2026-73412Shescape: Path disclosure on Unix with Zsh
Modified: 8/27/2026
MEDIUMnpm
GHSA-9jfh-9xrq-4vwm· CVE-2026-32094Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash
Modified: 3/13/2026
HIGH7.5npm
GHSA-cr84-xvw4-qx3c· CVE-2022-25918Inefficient Regular Expression Complexity in shescape
Modified: 11/8/2023
MEDIUM6.3npm
GHSA-f2rp-38vg-j3gh· CVE-2021-21384Null characters not escaped
Modified: 9/10/2026
HIGHnpm
GHSA-gm3r-q2wp-hw87· CVE-2026-73413Shescape: Quadratic-time denial of service in the flag-protection
Modified: 8/12/2026
HIGH8.6npm
GHSA-j55r-787p-m549· CVE-2023-40185Shescape on Windows escaping may be bypassed in threaded context
Modified: 11/8/2023
HIGH8.1npm
GHSA-jjc5-fp7p-6f8w· CVE-2022-31179Shescape prior to 1.5.8 vulnerable to insufficient escaping of line feeds for CMD
Modified: 11/8/2023
MEDIUMnpm
GHSA-q53c-4prm-w95q· CVE-2026-73411Shescape: Home-directory disclosure in assignment context on Unix with Dash
Modified: 8/12/2026
CRITICALnpm
GHSA-w4hw-qcx7-56pr· CVE-2026-73414Shescape: Shell injection via unescaped parentheses on Windows with CMD
Modified: 8/12/2026