Description

Shescape on Windows escaping may be bypassed in threaded context

Impact

This may impact users that use Shescape on Windows in a threaded context (e.g. using Worker threads). The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell.

This snippet demonstrates a vulnerable use of Shescape:

// vulnerable.js

import { exec } from "node:child_process";
import { Worker, isMainThread } from 'node:worker_threads';

import * as shescape from "shescape";

if (isMainThread) {...
Show more

Patches

This bug has been patched in v1.7.4 which you can upgrade to now. No further changes are required.

Workarounds

If you are impacted there is no workaround possible.

References

Shescape Pull Request #1142

Shescape commit 0b976da

Shescape release v1.7.4

For more information

Comment on Pull Request #1142

Comment on commit 0b976da

Open an issue at https://github.com/ericcornelissen/shescape/issues (New issue > Question > Get started)

Mitigation

Aliases

References