CVE-2023-35931CWE-526

Shescape potential environment variable exposure on Windows with CMD

Low · published June 23, 2023

CVSS v3.1
3.1
EPSS
1%
Percentile
56.5
In the wild
Unconfirmed
What it is

Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00811 · 56.5th percentile
Weakness
CWE-526 · Cleartext Storage of Sensitive Information in an Environment Variable
Published
2023-06-23T19:32Z
EPSS history
Timeline
  • 23 JUN 19:32Z
    Shescape potential environment variable exposure on Windows with CMD
    cvelistv5