CVE-2022-25918

    Dashboard / Vulnerabilities / CVE-2022-25918

    CVE-2022-25918

    Published: 27 Oct 2022Last Modified: 28 Oct 2026

    Summary: Regular Expression Denial of Service (ReDoS)

    Details: The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.

    References: https://github.com/ericcornelissen/shescape/blob/main/src/unix.js%23L52, https://github.com/ericcornelissen/shescape/releases/tag/v1.6.1, https://security.snyk.io/vuln/SNYK-JS-SHESCAPE-3061108, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25918.json, https://nvd.nist.gov/vuln/detail/CVE-2022-25918, https://github.com/ericcornelissen/shescape/commit/552e8eab56861720b1d4e5474fb65741643358f9

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 656ecbc798cb21ab95449d3fb4838a36dd09b6d8
    Fixed -dbc5c9d1b3325d45a5f060ff0cd4b3ff761cbbbc

    Affected versions

    1.5.10

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-25918 | CVE-DB