CVE-2022-31179 Insufficient escaping of line feeds for CMD in shescape
Attackers can inject commands into cmd.exe on Windows by exploiting insufficient line feed escaping in the shescape library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31179?
CVE-2022-31179 is a high-severity command injection vulnerability in ericcornelissen shescape, published on 1 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows An attacker can omit all arguments following their input by including a line feed character (`'\n'`) in the payload. This bug has been patched in [v1.5.8] which you can upgrade to now. No further changes are required. Alternatively, line feed characters (`'\n'`) can be stripped out manually or the user input can be made the last argument (this only limits the impact).
Weakness: CWE-74
Which versions are affected by CVE-2022-31179?
2 open source packages ship an affected version, including shescape. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
shescape npm | All versions | 1.5.8 |
shescape npm | All versions | 1.5.8 |
Products include Shescape Project Shescape.
How do I fix CVE-2022-31179?
Upgrade shescape to 1.5.8 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-31179 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31179 exists.
Other vulnerabilities in ericcornelissen shescape
- CVE-2022-31180 Insufficient escaping of whitespace in shescape
- CVE-2026-32094 Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash
- CVE-2023-40185 Shescape on Windows escaping may be bypassed in threaded context
- CVE-2021-21384 Null characters not escaped in shescape
- CVE-2022-24725 Exposure of home directory through shescape on Unix with Bash
Sources
Also known as GHSA-jjc5-fp7p-6f8w.