Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
CRITICAL severity

CVE-2022-31180 — shescape

CRITICALFix: ericcornelissen/shescape#322

CVE-2022-31180 is a critical-severity (CVSS 9.8) CWE-74 vulnerability in shescape. 1 public exploit reference exists, so weaponization risk is real. A fix is available for shescape — see the affected versions and patch details below.

Insufficient escaping of whitespace in shescape

Also known asGHSA-44vr-rwwj-p88h
Published
Aug 1, 2022
Updated
Aug 12, 2026
Affected
1 pkg
Patched
1 / 1
Exploits
1 known
Exploitation data as of Sep 18, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA’s SSVC triage for CVE-2022-31180.

EPSS Exploitation Probability

via FIRST.org ↗
1.9%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs79th percentile — riskier than 79% of all scored CVEsHighest risk

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

How urgent is this, really

CVE-2022-31180 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.

Where this sits among everything scored

Of 377,636 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

24other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
shescapenpm
16Kdownloads / week

Description

Impact

This only impacts users that use the escape or escapeAll functions with the interpolation option set to true. Example:

import cp from "node:child_process";
import * as shescape from "shescape";

// 1. Prerequisites
const options = {
  shell: "bash",
  // Or
  shell: "dash",
  // Or
  shell: "powershell.exe",
  // Or
  shell: "zsh",
  // Or
  shell: undefined, // Only if the default shell is one of the affected shells.
};

// 2. Attack (one of multiple)
const payload = "foo #bar";

// 3. Usage
let escapedPayload;
shescape.escape(payload, { interpolation: true });
// Or
shescape.escapeAll(payload, { interpolation: true });

cp.execSync(`echo Hello ${escapedPayload}!`, options);
// _Output depends on the shell being used_

The result is that if an attacker is able to include whitespace in their input they can:

  1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace.
    • Affected shells: Bash, Dash, Zsh, PowerShell
  2. Invoke shell-specific behaviour through shell-specific special characters inserted or appearing after line terminating characters.
    • Affected shells: Bash
  3. Invoke arbitrary commands by inserting a line feed character.
    • Affected Shells: Bash, Dash, Zsh, PowerShell
  4. Invoke arbitrary commands by inserting a carriage return character.
    • Affected Shells: PowerShell

Patches

Behaviour number 1 has been patched in v1.5.7 which you can upgrade to now. No further changes are required.

Behaviour number 2, 3, and 4 have been patched in v1.5.8 which you can upgrade to now. No further changes are required.

Workarounds

The best workaround is to avoid having to use the interpolation: true option - in most cases using an alternative is possible, see the recipes for recommendations.

Alternatively, you can strip all whitespace from user input. Note that this is error prone, for example: for PowerShell this requires stripping '\u0085' which is not included in JavaScript's definition of \s for Regular Expressions.

References

For more information

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmshescape≥ 1.4.0&&< 1.5.81.5.8npm install shescape@1.5.8
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

Shescape is a simple shell escape package for JavaScript. Affected versi…

github.comNVDAug 2022

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for shescape, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update shescape to 1.5.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-31180 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2022-31180 can be triaged on real exposure rather than presence alone.

Tailored to CVE-2022-31180. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Impact This only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. Example: ```javascript import cp from "node:child_process"; import * as shescape from "shescape"; // 1. Prerequisites const options = { shell: "bash", // Or shell: "dash", // Or shell: "powershell.exe", // Or shell: "zsh", // Or shell: undefined, // Only if the default shell is one of the affected shells. }; // 2. Attack (one of multiple) const payload = "foo #bar"; // 3. Usage let escapedPayload; shescape.escape(payload, { interpolation: true
O3 Security · Impact-Aware SCA

Is CVE-2022-31180 in your dependencies?

O3 Security finds CVE-2022-31180 across npm dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works
CVE-2022-31180: shescape (Critical 9.8) | O3 Security