CVE-2022-31180 Insufficient escaping of whitespace in shescape
Attackers can execute arbitrary commands via whitespace injection in shescape when interpolation is enabled, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31180?
CVE-2022-31180 is a critical command injection vulnerability in ericcornelissen shescape, published on 1 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. The result is that if an attacker is able to include whitespace in their input they can: 1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace. 2. Invoke shell-specific behaviour through shell-specific special characters inserted or appearing after line terminating characters. 3. Invoke arbitrary commands by inserting a line feed character. 4. Invoke arbitrary commands by inserting a carriage return character. Behaviour number 1 has been patched in [v1.5.7] which you can upgrade to now. No further changes are required. Behaviour number 2, 3, and 4 have been patched in [v1.5.8] which you can upgrade to now. No further changes are required. The best workaround is to avoid having to use the `interpolation: true` option - in most cases using an alternative is possible, see [the recipes](https://github.com/ericcornelissen/shescape#recipes) for recommendations. Alternatively, users may strip all whitespace from user input. Note that this is error prone, for example: for PowerShell this requires stripping `'\u0085'` which is not included in JavaScript's definition of `\s` for Regular Expressions.
Weakness: CWE-74
Which versions are affected by CVE-2022-31180?
2 open source packages ship an affected version, including shescape. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
shescape npm | From 1.4.0 | 1.5.8 |
shescape npm | From 1.4.0 | 1.5.8 |
Products include Shescape Project Shescape.
How do I fix CVE-2022-31180?
Upgrade shescape to 1.5.8 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-31180 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31180 exists.
Other vulnerabilities in ericcornelissen shescape
- CVE-2022-31179 Insufficient escaping of line feeds for CMD in shescape
- CVE-2026-32094 Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash
- CVE-2023-40185 Shescape on Windows escaping may be bypassed in threaded context
- CVE-2021-21384 Null characters not escaped in shescape
- CVE-2022-24725 Exposure of home directory through shescape on Unix with Bash
Sources
Also known as GHSA-44vr-rwwj-p88h.