NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
CRITICAL severity

CVE-2022-31180 — shescape

CRITICALFix: ericcornelissen/shescape#322

CVE-2022-31180 is a critical-severity (CVSS 9.8) CWE-74 vulnerability in shescape. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for shescape — see the affected versions and patch details below.

Insufficient escaping of whitespace in shescape

Also known asGHSA-44vr-rwwj-p88h
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
1 known
Exploitation data as of Nov 3, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA’s SSVC triage for CVE-2022-31180.

EPSS Exploitation Probability

via FIRST.org ↗
2.0%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs81th percentile — riskier than 81% of all scored CVEsHighest risk
0.58%1.22%1.86%2.49%1.1%2.0%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

23other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
shescapenpm
19Kdownloads / week

Description

Impact

This only impacts users that use the escape or escapeAll functions with the interpolation option set to true. Example:

import cp from "node:child_process";
import * as shescape from "shescape";

// 1. Prerequisites
const options = {
  shell: "bash",
  // Or
  shell: "dash",
  // Or
  shell: "powershell.exe",
  // Or
  shell: "zsh",
  // Or
  shell: undefined, // Only if the default shell is one of the affected shells.
};

// 2. Attack (one of multiple)
const payload = "foo #bar";

// 3. Usage
let escapedPayload;
shescape.escape(payload, { interpolation: true });
// Or
shescape.escapeAll(payload, { interpolation: true });

cp.execSync(`echo Hello ${escapedPayload}!`, options);
// _Output depends on the shell being used_

The result is that if an attacker is able to include whitespace in their input they can:

  1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace.
    • Affected shells: Bash, Dash, Zsh, PowerShell
  2. Invoke shell-specific behaviour through shell-specific special characters inserted or appearing after line terminating characters.
    • Affected shells: Bash
  3. Invoke arbitrary commands by inserting a line feed character.
    • Affected Shells: Bash, Dash, Zsh, PowerShell
  4. Invoke arbitrary commands by inserting a carriage return character.
    • Affected Shells: PowerShell

Patches

Behaviour number 1 has been patched in v1.5.7 which you can upgrade to now. No further changes are required.

Behaviour number 2, 3, and 4 have been patched in v1.5.8 which you can upgrade to now. No further changes are required.

Workarounds

The best workaround is to avoid having to use the interpolation: true option - in most cases using an alternative is possible, see the recipes for recommendations.

Alternatively, you can strip all whitespace from user input. Note that this is error prone, for example: for PowerShell this requires stripping '\u0085' which is not included in JavaScript's definition of \s for Regular Expressions.

References

For more information

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmshescape≥ 1.4.0&&< 1.5.81.5.8npm install shescape@1.5.8

Affected Products

1 product · 1 configurations
Application
shescapeshescape_project
≥ 1.4.0 && < 1.5.8
range
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

Shescape is a simple shell escape package for JavaScript. Affected versi…

github.comNVDAug 2022

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for shescape, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update shescape to 1.5.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-31180 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact This only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. Example: ```javascript import cp from "node:child_process"; import * as shescape from "shescape"; // 1. Prerequisites const options = { shell: "bash", // Or shell: "dash", // Or shell: "powershell.exe", // Or shell: "zsh", // Or shell: undefined, // Only if the default shell is one of the affected shells. }; // 2. Attack (one of multiple) const payload = "foo #bar"; // 3. Usage let escapedPayload; shescape.escape(payload, { interpolation: true
O3 Security · Impact-Aware SCA

Is CVE-2022-31180 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2022-31180: shescape — Fixed in 1.5.8