DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-GM3R-Q2WP-HW87: GHSA-gm3r-q2wp-hw87: Quadratic-Time Denial of Service via Flag-Protection in Shescape

#security #cve #cybersecurity #ghsa

GHSA-gm3r-q2wp-hw87: Quadratic-Time Denial of Service via Flag-Protection in Shescape

Vulnerability ID: GHSA-GM3R-Q2WP-HW87
CVSS Score: 8.7
Published: 2026-07-24

A high-severity algorithmic-complexity vulnerability in the Node.js library Shescape leads to a Quadratic-Time Denial of Service (DoS) when flag protection is enabled. By supplying inputs containing repetitive control characters and hyphens, remote attackers can trigger an inefficient nested loop in Shescape's argument-composition logic, blocking the Node.js single-threaded event loop and causing total application Denial of Service.

TL;DR

Shescape is vulnerable to an O(N^2) algorithmic complexity Denial of Service due to nested array copying and string joining inside its default flag-protection processing loop.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-407 / CWE-400
  • Attack Vector: Network
  • CVSS v4.0 Score: 8.7 (High)
  • Exploit Status: PoC Available
  • Remediation: Upgrade to v2.1.14 or v3.0.1
  • Impact: Application Denial of Service (CPU Exhaustion)

Affected Systems

  • Node.js applications utilizing shescape for command-argument escaping
  • shescape: >= 2.1.11, < 2.1.14 (Fixed in: 2.1.14)
  • shescape: >= 3.0.0, < 3.0.1 (Fixed in: 3.0.1)

Code Analysis

Commit: 43d70b5

Corrected vulnerability in compose.js by avoiding array reconstruction and destructuring during iteration; added Windows CMD and Dash/Zsh escaping improvements.

Commit: b4b34c3

Backport patch associated with the security advisory in version v2.1.14.

Mitigation Strategies

  • Upgrade Shescape to a patched version (v3.0.1 or v2.1.14)
  • Implement strict input length validation boundaries
  • Disable the flag-protection feature if not strictly required

Remediation Steps:

  1. Run 'npm install shescape@^3.0.1' or 'npm install shescape@^2.1.14' in your project root.
  2. Verify the installation of the patched version using npm list shescape.
  3. If updating is blocked, implement input validation checking that limits string inputs to less than 256 characters before passing them to shescape.

References

Read the full report for GHSA-GM3R-Q2WP-HW87 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)