CVE-2022-31179: Vulnerability in shescape package allows command injection
Summary
CVE-2022-31179: Shescape prior to 1.5.8 vulnerable to insufficient escaping of line feeds for CMD. Affects shescape versions < 1.5.8. Fixed in 1.5.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The shescape package is an npm package that provides functions for escaping arguments for command execution in various shells. It is commonly used to prevent command injection vulnerabilities when executing commands in a shell. However, versions prior to 1.5.8 of shescape are vulnerable to an insufficient escaping issue that can lead to command injection.
Vulnerability Detail
The vulnerability in shescape arises from the insufficient escaping of line feeds for CMD on Windows. An attacker can exploit this by including a line feed character in the payload, which allows them to omit all arguments following their input. This can be done through any API function of shescape used to escape arguments for cmd.exe. The impact of this vulnerability is that an attacker can manipulate the command execution and potentially execute arbitrary commands on the system. The vulnerability has a CVSS score of 8.1 (High).
How To Fix
Latest published version: 3.0.2 as of 23 Oct 2026
npm install shescape@3.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.8
This is the first release that contains the fix.
npm install shescape@1.5.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Alternatively, users can manually strip out line feed characters from the input payload or ensure that user input is the last argument in the command execution. However, these workarounds only limit the impact of the vulnerability and do not provide a complete fix.
Conclusion
The shescape package prior to version 1.5.8 is vulnerable to command injection due to insufficient escaping of line feeds for CMD on Windows. Users should upgrade to version 1.5.8 or later to fix this vulnerability. Alternatively, manual workarounds can be applied, but they only provide limited protection. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for shescape →
FAQ
Shescape is an npm package that provides functions for escaping arguments for command execution in various shells.
The vulnerability allows an attacker to manipulate command execution and potentially execute arbitrary commands on the system.
You can fix this vulnerability by upgrading to shescape version 1.5.8 or later.
You can manually strip out line feed characters from the input payload or ensure that user input is the last argument in the command execution, but these workarounds only limit the impact of the vulnerability.
The CVSS score of this vulnerability is 8.1 (High).
References
Related vulnerabilities
Recent vulnerabilities recorded for shescape.
