CVE-2026-73413 in Shescape
Summary
by MITRE • 08/12/2026
Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
The shescape library presents a significant performance vulnerability through its flag protection mechanism that manifests as a quadratic time complexity issue during shell command escaping operations. This vulnerability affects versions between 2.1.11 and 2.1.14, as well as version 3.0.1, where the internal compose function in src/internal/compose.js implements an inefficient loop structure when flagProtection is enabled by default. The flaw occurs specifically during the processing of untrusted input containing numerous flag fragments, causing the system to repeatedly join and slice these fragments in a manner that scales quadratically with input size rather than linearly.
The technical implementation issue stems from how the library handles flag protection within its core escaping algorithms. When flagProtection is activated, which represents the default configuration setting, the compose function enters into a computationally expensive loop where it continuously processes flag fragments through join and slice operations. This design flaw affects all public APIs including escape, escapeAll, quote, and quoteAll methods that utilize this internal composition logic. The quadratic time complexity means that as input size increases, processing time grows exponentially rather than proportionally, creating a predictable performance degradation pattern.
The operational impact of this vulnerability creates a substantial denial of service risk for applications relying on shescape for shell command construction or input sanitization. An attacker can exploit this weakness by providing maliciously crafted inputs containing numerous flag fragments that trigger the inefficient loop structure, causing excessive CPU consumption and potential system resource exhaustion. This vulnerability particularly affects web applications, server-side processing systems, and any environment where untrusted user input is processed through shell escaping mechanisms. The attack surface expands significantly in environments where shell command execution is required, making this a critical security concern for system administrators and developers.
This vulnerability maps directly to CWE-798, which addresses the use of hard-coded credentials and improper resource management, as well as CWE-400, which covers unspecified resource consumption vulnerabilities. From an attack framework perspective, this issue aligns with ATT&CK technique T1496 for resource exhaustion attacks and T1203 for exploitation of software vulnerabilities. The fix implemented in versions 2.1.14 and 3.0.1 addresses the root cause by optimizing the flag protection loop to eliminate the quadratic time complexity through algorithmic improvements that ensure linear processing regardless of input size.
Mitigation strategies should focus on immediate version upgrades to 2.1.14 or 3.0.1 to resolve the core implementation flaw. Organizations should also implement input validation and size limits for any untrusted data processed through shell escaping functions, establishing rate limiting mechanisms to prevent abuse of this vulnerability. Additionally, monitoring systems should be configured to detect unusual CPU utilization patterns that might indicate exploitation attempts. Security teams should conduct thorough code reviews of other libraries that may utilize similar flag protection mechanisms and consider implementing automated testing that includes large input stress scenarios to identify potential performance vulnerabilities before deployment in production environments.