CVE-2026-73413

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73413
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73413.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73413
Aliases
Published
2026-08-12T19:40:46.046Z
Modified
2026-08-15T11:31:09.648276404Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Shescape: Quadratic-time denial of service in flag-protection
Details

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1.

Database specific 
{
    "cwe_ids": [
        "CWE-400",
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73413.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/ericcornelissen/shescape

Affected ranges

Type
GIT
Repo
https://github.com/ericcornelissen/shescape
Events
Introduced
b1a0f675275a20c285aaea179e4e8e00b211ef1d
Introduced
68b9e590b7527fd9dbde91c450055059423942f6
Fixed
ae0faa7bd31331aec3f21c623ee69a50e6663454
Fixed
37303332910d456bf07bbf942c3ed98be156f365
Fixed
43d70b59d09bbe5c3fd02ef08b3a123e977ed9de
Fixed
b4b34c394e7f9da2775bb75381066b9a228c425f
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.1.11"
        },
        {
            "fixed": "2.1.14"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.1"
        }
    ]
}

Affected versions

v2.*
v2.1.11
v2.1.12
v2.1.13
v3.*
v3.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73413.json"