{"id":"CVE-2022-31180","aliases":["EUVD-2022-6224","GHSA-44vr-rwwj-p88h"],"status":"published","title":"Insufficient escaping of whitespace in shescape","description":"Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. The result is that if an attacker is able to include whitespace in their input they can: 1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace. 2. Invoke shell-specific behaviour through shell-specific special characters inserted or appearing after line terminating characters. 3. Invoke arbitrary commands by inserting a line feed character. 4. Invoke arbitrary commands by inserting a carriage return character. Behaviour number 1 has been patched in [v1.5.7] which you can upgrade to now. No further changes are required. Behaviour number 2, 3, and 4 have been patched in [v1.5.8] which you can upgrade to now. No further changes are required. The best workaround is to avoid having to use the `interpolation: true` option - in most cases using an alternative is possible, see [the recipes](https://github.com/ericcornelissen/shescape#recipes) for recommendations. Alternatively, users may strip all whitespace from user input. Note that this is error prone, for example: for PowerShell this requires stripping `'\\u0085'` which is not included in JavaScript's definition of `\\s` for Regular Expressions.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01993,"percentile":0.8085,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2022-07-15T21:46:08Z","modified":"2026-10-28T02:30:49Z","fixes":[{"ecosystem":"npm","package":"shescape","fixed_in":["1.5.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"shescape","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.5.8"}]}]},{"source":"osv","ecosystem":"npm","package":"shescape","ranges":[{"type":"SEMVER","events":[{"introduced":"1.4.0"},{"fixed":"1.5.8"}]}]}],"products":[{"vendor":"ericcornelissen","product":"shescape"},{"vendor":"shescape_project","product":"shescape"}],"references":[{"url":"https://github.com/ericcornelissen/shescape/security/advisories/GHSA-44vr-rwwj-p88h","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://github.com/ericcornelissen/shescape/pull/322","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/ericcornelissen/shescape/pull/324","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/ericcornelissen/shescape/releases/tag/v1.5.7","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://github.com/ericcornelissen/shescape/pull/332","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31180","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-44vr-rwwj-p88h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31180.json","tags":["advisory"]},{"url":"https://github.com/ericcornelissen/shescape","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-31180","title":"Insufficient escaping of whitespace in shescape","description":"Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. The result is that if an attacker is able to include whitespace in their input they can: 1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace. 2. Invoke shell-specific behaviour through shell-specific special characters inserted or appearing after line terminating characters. 3. Invoke arbitrary commands by inserting a line feed character. 4. Invoke arbitrary commands by inserting a carriage return character. Behaviour number 1 has been patched in [v1.5.7] which you can upgrade to now. No further changes are required. Behaviour number 2, 3, and 4 have been patched in [v1.5.8] which you can upgrade to now. No further changes are required. The best workaround is to avoid having to use the `interpolation: true` option - in most cases using an alternative is possible, see [the recipes](https://github.com/ericcornelissen/shescape#recipes) for recommendations. Alternatively, users may strip all whitespace from user input. Note that this is error prone, for example: for PowerShell this requires stripping `'\\u0085'` which is not included in JavaScript's definition of `\\s` for Regular Expressions.","status":"published","published":"2022-08-01T19:15:16Z","modified":"2025-04-22T17:46:22.04Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:34:35.279735Z"}],"euvd":[{"id":"EUVD-2022-6224","description":"Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. The result is that if an attacker is able to include whitespace in their input they can: 1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace. 2. Invoke shell-specific behaviour through shell-specific special characters inserted or appearing after line terminating characters. 3. Invoke arbitrary commands by inserting a line feed character. 4. Invoke arbitrary commands by inserting a carriage return character. Behaviour number 1 has been patched in [v1.5.7] which you can upgrade to now. No further changes are required. Behaviour number 2, 3, and 4 have been patched in [v1.5.8] which you can upgrade to now. No further changes are required. The best workaround is to avoid having to use the `interpolation: true` option - in most cases using an alternative is possible, see [the recipes](https://github.com/ericcornelissen/shescape#recipes) for recommendations. Alternatively, users may strip all whitespace from user input. Note that this is error prone, for example: for PowerShell this requires stripping `'\\u0085'` which is not included in JavaScript's definition of `\\s` for Regular Expressions.","status":"published","published":"2022-08-01T19:15:16Z","modified":"2025-04-22T17:46:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:15.540112Z"}],"ghsa":[{"id":"GHSA-44vr-rwwj-p88h","title":"Shescape vulnerable to insufficient escaping of whitespace","description":"### Impact\n\nThis only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. Example:\n\n```javascript\nimport cp from \"node:child_process\";\nimport * as shescape from \"shescape\";\n\n// 1. Prerequisites\nconst options = {\n  shell: \"bash\",\n  // Or\n  shell: \"dash\",\n  // Or\n  shell: \"powershell.exe\",\n  // Or\n  shell: \"zsh\",\n  // Or\n  shell: undefined, // Only if the default shell is one of the affected shells.\n};\n\n// 2. Attack (one of multiple)\nconst payload = \"foo #bar\";\n\n// 3. Usage\nlet escapedPayload;\nshescape.escape(payload, { interpolation: true });\n// Or\nshescape.escapeAll(payload, { interpolation: true });\n\ncp.execSync(`echo Hello ${escapedPayload}!`, options);\n// _Output depends on the shell being used_\n```\n\nThe result is that if an attacker is able to include whitespace in their input they can:\n\n1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace.\n   - Affected shells: _Bash_, _Dash_, _Zsh_, _PowerShell_\n2. Invoke shell-specific behaviour through shell-specific special characters inserted or appearing after line terminating characters. \n   - Affected shells: _Bash_\n3. Invoke arbitrary commands by inserting a line feed character.\n   - Affected Shells: _Bash_, _Dash_, _Zsh_, _PowerShell_\n3. Invoke arbitrary commands by inserting a carriage return character.\n   - Affected Shells: _PowerShell_\n\n### Patches\n\nBehaviour number 1 has been patched in [v1.5.7] which you can upgrade to now. No further changes are required.\n\nBehaviour number 2, 3, and 4 have been patched in [v1.5.8] which you can upgrade to now. No further changes are required.\n\n### Workarounds\n\nThe best workaround is to avoid having to use the `interpolation: true` option - in most cases using an alternative is possible, see [the recipes](https://github.com/ericcornelissen/shescape#recipes) for recommendations.\n\nAlternatively, you can strip all whitespace from user input. Note that this is error prone, for example: for PowerShell this requires stripping `'\\u0085'` which is not included in JavaScript's definition of `\\s` for Regular Expressions.\n\n### References\n\n- https://github.com/ericcornelissen/shescape/pull/322\n- https://github.com/ericcornelissen/shescape/pull/324\n- https://github.com/ericcornelissen/shescape/pull/332\n- https://github.com/ericcornelissen/shescape/releases/tag/v1.5.7\n- https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8\n\n### For more information\n\n- Comment on:\n  - For behaviour 1 (PowerShell): https://github.com/ericcornelissen/shescape/pull/322\n  - For behaviour 1 (Bash, Dash, Zsh): https://github.com/ericcornelissen/shescape/pull/324\n  - For behaviour 2, 3, 4 (_any shell_): https://github.com/ericcornelissen/shescape/pull/332\n- Open an issue at https://github.com/ericcornelissen/shescape/issues (_New issue_ \u003e _Question_ \u003e _Get started_)\n- If you're missing CMD from this advisory, see https://github.com/ericcornelissen/shescape/security/advisories/GHSA-jjc5-fp7p-6f8w\n\n[v1.5.7]: https://github.com/ericcornelissen/shescape/releases/tag/v1.5.7\n[v1.5.8]: https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8\n\n","status":"published","published":"2022-07-15T21:46:08Z","modified":"2023-01-31T05:01:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:36:29.100018Z"}],"nvd":[{"id":"CVE-2022-31180","description":"Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. The result is that if an attacker is able to include whitespace in their input they can: 1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace. 2. Invoke shell-specific behaviour through shell-specific special characters inserted or appearing after line terminating characters. 3. Invoke arbitrary commands by inserting a line feed character. 4. Invoke arbitrary commands by inserting a carriage return character. Behaviour number 1 has been patched in [v1.5.7] which you can upgrade to now. No further changes are required. Behaviour number 2, 3, and 4 have been patched in [v1.5.8] which you can upgrade to now. No further changes are required. The best workaround is to avoid having to use the `interpolation: true` option - in most cases using an alternative is possible, see [the recipes](https://github.com/ericcornelissen/shescape#recipes) for recommendations. Alternatively, users may strip all whitespace from user input. Note that this is error prone, for example: for PowerShell this requires stripping `'\\u0085'` which is not included in JavaScript's definition of `\\s` for Regular Expressions.","status":"published","published":"2022-08-01T20:15:08.237Z","modified":"2026-06-17T04:44:58.363Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:07:24.39467Z"}],"osv":[{"id":"CVE-2022-31180","title":"Insufficient escaping of whitespace in shescape","description":"Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. The result is that if an attacker is able to include whitespace in their input they can: 1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace. 2. Invoke shell-specific behaviour through shell-specific special characters inserted or appearing after line terminating characters. 3. Invoke arbitrary commands by inserting a line feed character. 4. Invoke arbitrary commands by inserting a carriage return character. Behaviour number 1 has been patched in [v1.5.7] which you can upgrade to now. No further changes are required. Behaviour number 2, 3, and 4 have been patched in [v1.5.8] which you can upgrade to now. No further changes are required. The best workaround is to avoid having to use the `interpolation: true` option - in most cases using an alternative is possible, see [the recipes](https://github.com/ericcornelissen/shescape#recipes) for recommendations. Alternatively, users may strip all whitespace from user input. Note that this is error prone, for example: for PowerShell this requires stripping `'\\u0085'` which is not included in JavaScript's definition of `\\s` for Regular Expressions.","status":"published","published":"2022-08-01T19:15:16Z","modified":"2026-10-28T02:30:49.001546214Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"GHSA-44vr-rwwj-p88h","title":"Shescape vulnerable to insufficient escaping of whitespace","description":"### Impact\n\nThis only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. Example:\n\n```javascript\nimport cp from \"node:child_process\";\nimport * as shescape from \"shescape\";\n\n// 1. Prerequisites\nconst options = {\n  shell: \"bash\",\n  // Or\n  shell: \"dash\",\n  // Or\n  shell: \"powershell.exe\",\n  // Or\n  shell: \"zsh\",\n  // Or\n  shell: undefined, // Only if the default shell is one of the affected shells.\n};\n\n// 2. Attack (one of multiple)\nconst payload = \"foo #bar\";\n\n// 3. Usage\nlet escapedPayload;\nshescape.escape(payload, { interpolation: true });\n// Or\nshescape.escapeAll(payload, { interpolation: true });\n\ncp.execSync(`echo Hello ${escapedPayload}!`, options);\n// _Output depends on the shell being used_\n```\n\nThe result is that if an attacker is able to include whitespace in their input they can:\n\n1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace.\n   - Affected shells: _Bash_, _Dash_, _Zsh_, _PowerShell_\n2. Invoke shell-specific behaviour through shell-specific special characters inserted or appearing after line terminating characters. \n   - Affected shells: _Bash_\n3. Invoke arbitrary commands by inserting a line feed character.\n   - Affected Shells: _Bash_, _Dash_, _Zsh_, _PowerShell_\n3. Invoke arbitrary commands by inserting a carriage return character.\n   - Affected Shells: _PowerShell_\n\n### Patches\n\nBehaviour number 1 has been patched in [v1.5.7] which you can upgrade to now. No further changes are required.\n\nBehaviour number 2, 3, and 4 have been patched in [v1.5.8] which you can upgrade to now. No further changes are required.\n\n### Workarounds\n\nThe best workaround is to avoid having to use the `interpolation: true` option - in most cases using an alternative is possible, see [the recipes](https://github.com/ericcornelissen/shescape#recipes) for recommendations.\n\nAlternatively, you can strip all whitespace from user input. Note that this is error prone, for example: for PowerShell this requires stripping `'\\u0085'` which is not included in JavaScript's definition of `\\s` for Regular Expressions.\n\n### References\n\n- https://github.com/ericcornelissen/shescape/pull/322\n- https://github.com/ericcornelissen/shescape/pull/324\n- https://github.com/ericcornelissen/shescape/pull/332\n- https://github.com/ericcornelissen/shescape/releases/tag/v1.5.7\n- https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8\n\n### For more information\n\n- Comment on:\n  - For behaviour 1 (PowerShell): https://github.com/ericcornelissen/shescape/pull/322\n  - For behaviour 1 (Bash, Dash, Zsh): https://github.com/ericcornelissen/shescape/pull/324\n  - For behaviour 2, 3, 4 (_any shell_): https://github.com/ericcornelissen/shescape/pull/332\n- Open an issue at https://github.com/ericcornelissen/shescape/issues (_New issue_ \u003e _Question_ \u003e _Get started_)\n- If you're missing CMD from this advisory, see https://github.com/ericcornelissen/shescape/security/advisories/GHSA-jjc5-fp7p-6f8w\n\n[v1.5.7]: https://github.com/ericcornelissen/shescape/releases/tag/v1.5.7\n[v1.5.8]: https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8\n\n","status":"published","published":"2022-07-15T21:46:08Z","modified":"2023-11-08T04:09:29.015822Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:36.434231Z"}]}}