High severity · published Oct 27, 2022
CVE-2022-25918
Regular Expression Denial of Service (ReDoS)
7.5
CVSS
1.6%
EPSS
No
On KEV
Description
The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
shescape ·
1.5.10 before unspecified; before 1.6.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-25918
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-25918
Broken Link
https://github.com/ericcornelissen/shescape/blob/main/src/unix.js%23L52
Patch
https://github.com/ericcornelissen/shescape/commit/552e8eab56861720b1d4e5474fb65741643358f9
Release Notes
https://github.com/ericcornelissen/shescape/releases/tag/v1.6.1
Exploit
https://security.snyk.io/vuln/SNYK-JS-SHESCAPE-3061108