-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability documentation explicitly states impact occurs when using escape/escapeAll with interpolation:true. Multiple pull requests (#322, #324, #332) modifying escaping logic for these functions were required to patch different attack vectors. The functions' purpose (shell escaping) and explicit mention in all impact scenarios make them clear candidates.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shescape | npm | >= 1.4.0, < 1.5.8 | 1.5.8 |
The best workaround is to avoid having to use the interpolation: true option - in most cases using an alternative is possible, see the recipes for recommendations.
Alternatively, you can strip all whitespace from user input. Note that this is error prone, for example: for PowerShell this requires stripping '\u0085' which is not included in JavaScript's definition of \s for Regular Expressions.
Ongoing coverage of React2Shell