CVE-2026-73413

{
  "id": "CVE-2026-73413",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-12T20:17:56.350",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1."
    },
    {
      "lang": "es",
      "value": "Shescape es una simple biblioteca de escape de shell para JavaScript. Desde la versión 2.1.11 hasta la 2.1.14 y la 3.0.1, el bucle de protección de banderas en compose en src/internal/compose.js une y divide repetidamente fragmentos de banderas cuando flagProtection está habilitado, lo cual es el valor predeterminado, haciendo que el procesamiento sea cuadrático en el tamaño de la entrada a través de las APIs escape, escapeAll, quote y quoteAll. Un atacante que puede proporcionar una entrada grande no confiable que contiene muchos fragmentos de banderas puede consumir CPU y causar denegación de servicio. Este problema está solucionado en las versiones 2.1.14 y 3.0.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ericcornelissen",
          "product": "shescape",
          "versions": [
            {
              "version": ">= 2.1.11, < 2.1.14",
              "status": "affected"
            },
            {
              "version": ">= 3.0.0, < 3.0.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-13T14:17:17.539995Z",
          "id": "CVE-2026-73413",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-407"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ericcornelissen/shescape/pull/2649",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ericcornelissen/shescape/pull/2651",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87",
      "source": "[email protected]"
    }
  ]
}