ericcornelissen shescape up to 2.1.1 environment information disclosure

Summaryinfo

A vulnerability was found in ericcornelissen shescape up to 2.1.1. It has been classified as problematic. Affected is an unknown function. The manipulation of the argument environment leads to information disclosure. This vulnerability is referenced as CVE-2025-30222. The attack can only be performed from a local environment. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in ericcornelissen shescape up to 2.1.1. It has been rated as problematic. This issue affects an unknown code block. The manipulation of the argument environment with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure `shell: 'cmd.exe'` or `shell: true` using any of `quote`/`quoteAll`/`escape`/`escapeAll`. An attacker may be able to get read-only access to environment variables. This bug has been patched in v2.1.2. For those who are already using v2 of Shescape, no further changes are required. Those who are are using v1 of Shescape should follow the migration guide to upgrade to v2. There is no plan to release a patch compatible with v1 of Shescape. As a workaround, users can remove all instances of `%` from user input before using Shescape.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-30222 since 03/18/2025. The exploitation is known to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 2.1.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 0a81f1eb077bab8caae283a2490cd7be9af179c6 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• ericcornelissen

Name

• shescape

Version

• 2.1.0
• 2.1.1

License

• open-source

Website

• Product: https://github.com/ericcornelissen/shescape/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion