CVE-2022-31179

    Dashboard / Vulnerabilities / CVE-2022-31179

    CVE-2022-31179

    Published: 1 Aug 2022Last Modified: 12 Aug 2026

    Summary: Insufficient escaping of line feeds for CMD in shescape

    Details: Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows An attacker can omit all arguments following their input by including a line feed character (`'\n'`) in the payload. This bug has been patched in [v1.5.8] which you can upgrade to now. No further changes are required. Alternatively, line feed characters (`'\n'`) can be stripped out manually or the user input can be made the last argument (this only limits the impact).

    References: https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31179.json, https://github.com/ericcornelissen/shescape/security/advisories/GHSA-jjc5-fp7p-6f8w, https://nvd.nist.gov/vuln/detail/CVE-2022-31179, https://github.com/ericcornelissen/shescape/pull/332

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -8b6a0eefe08f9cd4340c3364aa90dda0acb31f18

    Affected versions

    v1.5.7
    v1.5.6
    v1.5.5
    v1.5.4
    v1.5.3
    v1.5.2
    v1.5.1
    v1.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31179 | CVE-DB