CVE-2026-73413

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73413", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-12T14:32:11.795Z", "datePublished": "2026-08-12T19:40:46.046Z", "dateUpdated": "2026-08-13T14:18:12.252Z"}, "containers": {"cna": {"title": "Shescape: Quadratic-time denial of service in flag-protection", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-407", "lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87"}, {"name": "https://github.com/ericcornelissen/shescape/pull/2649", "tags": ["x_refsource_MISC"], "url": "https://github.com/ericcornelissen/shescape/pull/2649"}, {"name": "https://github.com/ericcornelissen/shescape/pull/2651", "tags": ["x_refsource_MISC"], "url": "https://github.com/ericcornelissen/shescape/pull/2651"}, {"name": "https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de", "tags": ["x_refsource_MISC"], "url": "https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de"}, {"name": "https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f", "tags": ["x_refsource_MISC"], "url": "https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f"}, {"name": "https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14", "tags": ["x_refsource_MISC"], "url": "https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14"}, {"name": "https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1"}], "affected": [{"vendor": "ericcornelissen", "product": "shescape", "versions": [{"version": ">= 2.1.11, < 2.1.14", "status": "affected"}, {"version": ">= 3.0.0, < 3.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T19:40:46.046Z"}, "descriptions": [{"lang": "en", "value": "Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1."}], "source": {"advisory": "GHSA-gm3r-q2wp-hw87", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T14:17:17.539995Z", "id": "CVE-2026-73413", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T14:18:12.252Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73413", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T14:17:17.539995Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T14:18:03.252Z"}}], "cna": {"title": "Shescape: Quadratic-time denial of service in flag-protection", "source": {"advisory": "GHSA-gm3r-q2wp-hw87", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "ericcornelissen", "product": "shescape", "versions": [{"status": "affected", "version": ">= 2.1.11, < 2.1.14"}, {"status": "affected", "version": ">= 3.0.0, < 3.0.1"}]}], "references": [{"url": "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87", "name": "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ericcornelissen/shescape/pull/2649", "name": "https://github.com/ericcornelissen/shescape/pull/2649", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ericcornelissen/shescape/pull/2651", "name": "https://github.com/ericcornelissen/shescape/pull/2651", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de", "name": "https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f", "name": "https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14", "name": "https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1", "name": "https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-407", "description": "CWE-407: Inefficient Algorithmic Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T19:40:46.046Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73413", "state": "PUBLISHED", "dateUpdated": "2026-08-13T14:18:12.252Z", "dateReserved": "2026-08-12T14:32:11.795Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-12T19:40:46.046Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "shescape", "vendor": "ericcornelissen", "versions": [{"status": "affected", "version": ">= 2.1.11, < 2.1.14"}, {"status": "affected", "version": ">= 3.0.0, < 3.0.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1."}, {"lang": "es", "value": "Shescape es una simple biblioteca de escape de shell para JavaScript. Desde la versi\u00f3n 2.1.11 hasta la 2.1.14 y la 3.0.1, el bucle de protecci\u00f3n de banderas en compose en src/internal/compose.js une y divide repetidamente fragmentos de banderas cuando flagProtection est\u00e1 habilitado, lo cual es el valor predeterminado, haciendo que el procesamiento sea cuadr\u00e1tico en el tama\u00f1o de la entrada a trav\u00e9s de las APIs escape, escapeAll, quote y quoteAll. Un atacante que puede proporcionar una entrada grande no confiable que contiene muchos fragmentos de banderas puede consumir CPU y causar denegaci\u00f3n de servicio. Este problema est\u00e1 solucionado en las versiones 2.1.14 y 3.0.1."}], "id": "CVE-2026-73413", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73413", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T14:17:17.539995Z", "version": "2.0.3"}}]}, "published": "2026-08-12T20:17:56.350", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de"}, {"source": "security-advisories@github.com", "url": "https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f"}, {"source": "security-advisories@github.com", "url": "https://github.com/ericcornelissen/shescape/pull/2649"}, {"source": "security-advisories@github.com", "url": "https://github.com/ericcornelissen/shescape/pull/2651"}, {"source": "security-advisories@github.com", "url": "https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14"}, {"source": "security-advisories@github.com", "url": "https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-407"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.1.11,2.1.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "shescape", "source": "cna", "vendor": "ericcornelissen"}, "product": "shescape", "vendor": "ericcornelissen"}], "created": "2026-08-12T21:15:09.343282+00:00", "updated": "2026-08-12T23:15:03.539043+00:00", "vendors": ["ericcornelissen", "ericcornelissen$PRODUCT$shescape"]}