CVE-2026-73413

Received Received - Intake

Denial of Service in Shescape JavaScript Library

Publication date: 2026-08-12

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-13

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73413

EUVD

EUVD-2026-57527

Affected Vendors & Products

Vendor	Product	Version / Range
shescape	shescape	From 2.1.11 (inc) to 2.1.14 (inc)
shescape	shescape	2.1.14
shescape	shescape	3.0.1
ericcornelissen	shescape	From 2.1.11 (inc) to 2.1.14 (exc)
ericcornelissen	shescape	From 3.0.0 (inc) to 3.0.1 (exc)
ericcornelissen	shescape	2.1.14
ericcornelissen	shescape	3.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-service issue in the Shescape library versions 2.1.11 to 2.1.14 and 3.0.1. When flag protection is enabled (default setting), processing large inputs with many flag fragments causes quadratic runtime complexity. This means the time and CPU resources required grow disproportionately with input size, leading to excessive computation and potential system slowdowns.

Detection Guidance

To detect this vulnerability, check if your system uses Shescape versions between 2.1.11 and 2.1.14 or version 3.0.0. Run commands like 'npm list shescape' or 'npm ls shescape' to verify the installed version. If the version falls within the vulnerable range, the system is potentially affected.

Impact Analysis

An attacker could exploit this by providing a large malicious input containing many flag fragments. This would consume excessive CPU resources, causing denial-of-service by slowing down or crashing the affected application. The impact affects all Shescape APIs when flag protection is enabled.

Compliance Impact

This vulnerability primarily causes denial-of-service through excessive CPU consumption, which could impact system availability. While not directly violating GDPR or HIPAA, prolonged unavailability of systems processing sensitive data (e.g., personal health information) could lead to compliance issues if it disrupts access to required data or services.

Mitigation Strategies

Immediately update Shescape to version 2.1.14 or 3.0.1. If updating is not possible, restrict input length or strip content before the last hyphen to reduce the risk of exploitation. Monitor system performance for unusual CPU usage spikes.

Hi! I’m here to help you understand CVE-2026-73413. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70