Skip to main content
VulnerabilityPublished 07/24/2026

Shescape: Quadratic-time denial of service in the flag-protection

Affects shescapeSource GCVE Database

Severity
High

Rated by Threat Radar

Patch
Available – fixed in 2.1.14, 3.0.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What to do

AI-suggested

Upgrade to Shescape version 2.1.14 or later, or 3.0.1 or later, where this vulnerability is patched. If upgrading is not immediately possible, mitigate by restricting the length of untrusted inputs or stripping all content before the last '-' character from untrusted inputs. No patches are available for versions below 2.0.0.

Affected software

ProductAffectedFixed in
npmshescapeAffected
  • >=2.1.11 <2.1.14
Fixed in
  • 2.1.14
npmshescapeAffected
  • >=3.0.0 <3.0.1
Fixed in
  • 3.0.1

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Shescape versions 2.1.11 through 2.1.13 and 3.0.0 are vulnerable to a quadratic-time denial of service when flag protection is enabled (enabled by default). An attacker can supply large inputs that cause the runtime to increase quadratically, leading to denial of service. The issue has been patched in versions 2.1.14 and 3.0.1. Users are advised to upgrade to these versions or apply workarounds such as restricting input length or stripping content before the last '-' character in untrusted inputs.

Weaknesses

References