GHSA-44vr-rwwj-p88h · Severity: critical · Ecosystem: npm — Shescape vulnerable to insufficient escaping of whitespace
Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. The result is that if an attacker is able to include whitespace in their input they can: 1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace. 2. Invoke shell-specific behaviour through shell-specific special characters inserted or appearing after line terminating characters. 3. Invoke arbitrary commands by inserting a line feed character. 4. Invoke arbitrary commands by inserting a carriage return character. Behaviour number 1 has been patched in [v1.5.7] which you can upgrade to now. No further changes are required. Behaviour number 2, 3, and 4 have been patched in [v1.5.8] which you can upgrade to now. No further changes are required. The best workaround is to avoid having to use the `interpolation: true` option - in most cases using an alternative is possible, see [the recipes](https://github.com/ericcornelissen/shescape#recipes) for recommendations. Alternatively, users may strip all whitespace from user input. Note that this is error prone, for example: for PowerShell this requires stripping `'\u0085'` which is not included in JavaScript's definition of `\s` for Regular Expressions.
Conclusion & alert: CVE-2022-31180 is rated High Exploit Risk (81.4/100): CVSS Critical severity, with medium exploitation likelihood (EPSS 1.08%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-01-25 | 1.03% | 1.08% | +0.06% |
| 2 | 2025-08-11 | 0.48% | 1.03% | +0.55% |
| 3 | 2025-08-02 | — | 0.48% | — |
Full EPSS history (14 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.8 | 3.1 | CRITICAL |
|
3.9 | 5.9 | [email protected] |
| 9.8 | 3.1 | CRITICAL |
|
3.9 | 5.9 | [email protected] |
GHSA-44vr-rwwj-p88h · Severity: critical · Ecosystem: npm — Shescape vulnerable to insufficient escaping of whitespace
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| shescape_project | shescape | >= 1.4.0, < 1.5.8 | cpe:2.3:a:shescape_project:shescape:*:*:*:*:*:*:*:* |
| URL | Tags |
|---|---|
| https://github.com/ericcornelissen/shescape/pull/322 | Patch Third Party Advisory |
| https://github.com/ericcornelissen/shescape/pull/324 | Patch Third Party Advisory |
| https://github.com/ericcornelissen/shescape/releases/tag/v1.5.7 | Release Notes Third Party Advisory |
| https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8 | Release Notes Third Party Advisory |
| https://github.com/ericcornelissen/shescape/security/advisories/GHSA-44vr-rwwj-p88h | Exploit Third Party Advisory |