CVE-2026-73413CWE-400CWE-407denial-of-service

CVE-2026-73413

published August 13, 2026

CVSS
8.7
EPSS
1%
Percentile
47.5
In the wild
Unconfirmed
What it is

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00590 · 47.5th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-407 · Inefficient Algorithmic Complexity
Published
2026-08-13T00:17Z
References (7)
https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de · [email protected]https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f · [email protected]https://github.com/ericcornelissen/shescape/pull/2649 · [email protected]https://github.com/ericcornelissen/shescape/pull/2651 · [email protected]https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14 · [email protected]https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1 · [email protected]https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87 · [email protected]
EPSS history
Timeline
  • 12 AUG 19:40Z
    Shescape: Quadratic-time denial of service in flag-protection
    cvelistv5