CVE-2022-25918

Regular Expression Denial of Service (ReDoS)

Medium · published October 27, 2022

CVSS v3.1
5.3
EPSS
1%
Percentile
71.4
In the wild
Unconfirmed
What it is

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01356 · 71.4th percentile
Published
2022-10-27T05:05Z
EPSS history
Timeline
  • 27 OCT 05:05Z
    Regular Expression Denial of Service (ReDoS)
    cvelistv5