CVE-2023-40185: Shescape on Windows escaping may be bypassed in threaded context
Summary
CVE-2023-40185: Shescape on Windows escaping may be bypassed in threaded context. Affects shescape versions < 1.7.4. Fixed in 1.7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shescape is an open-source library for escaping and quoting shell commands in various programming languages. It provides a secure way to handle user input and prevent command injection attacks. This vulnerability affects Shescape on Windows when used in a threaded context, such as with Worker threads in Node.js. The vulnerability allows attackers to bypass shell escaping protections by exploiting the incorrect shell selection. This can lead to the execution of unintended commands and potential security breaches.
Vulnerability Detail
The vulnerability arises from a misconfiguration in the use of Shescape on Windows in a threaded context. In the vulnerable scenario, a worker thread is used, which unexpectedly changes environment variable names on Windows. The configuration specifies the use of PowerShell as the shell, but Shescape fails to look up PowerShell and defaults to escaping for CMD instead. This results in incorrect escaping and quoting for the shell, allowing attackers to bypass protections. The impact of this vulnerability depends on the combination of the expected and used shell, potentially leading to command injection and unauthorized command execution.
How To Fix
Latest published version: 3.0.2 as of 23 Oct 2026
npm install shescape@3.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.4
This is the first release that contains the fix.
npm install shescape@1.7.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Unfortunately, there is no workaround available for this vulnerability. Upgrading to the patched version is the only solution to mitigate the risk.
Conclusion
The vulnerability in Shescape on Windows in a threaded context can allow attackers to bypass shell escaping protections and execute unauthorized commands. It is crucial to upgrade to the patched version (1.7.4) of Shescape to mitigate the risk. No workarounds are available for this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for shescape →
FAQ
The vulnerability affects Shescape on Windows when used in a threaded context, such as with Worker threads in Node.js. It allows attackers to bypass shell escaping protections and potentially execute unauthorized commands.
The vulnerability is caused by a misconfiguration in the use of Shescape on Windows. It fails to correctly select the intended shell, resulting in incorrect escaping and quoting.
The impact of this vulnerability depends on the combination of the expected and used shell. It can lead to command injection and unauthorized command execution, potentially compromising the security of the system.
Yes, the vulnerability has been patched in version 1.7.4 of Shescape. It is recommended to upgrade to the latest version to mitigate the risk.
Unfortunately, there are no workarounds available for this vulnerability. Upgrading to the patched version is the only solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for shescape.
