CVE-2023-35931

Что произошло

### Impact This impact users of Shescape: 1. On Windows using the Windows Command Prompt (i.e. `cmd.exe`), and 2. Using `quote`/`quoteAll` or `escape`/`escapeAll` with the `interpolation` option set to `true`. An attacker may be able to get read-only access to environment variables. Example: ```javascript import * as cp from "node:child_process"; import * as shescape from "shescape"; // 1. Prerequisites const options = { shell: "cmd.exe", // Or shell: undefined, // Only if the default shell is CMD // And interpolation: true, // Only applies to `escape` and `escapeAll` usage } // 2. Attack (one of many) const payload = "%PATH%"; // 3. Usage let escapedPayload; escapedPayload = shescape.quote(payload, options); // Or escapedPayload = shescape.quoteAll([payload], options); // Or escapedPayload = shescape.escape(payload, options); // Or escapedPayload = shescape.escapeAll([payload], options); // And (example) const result = cp.execSync(`echo Hello ${escapedPayload}`, options); // 4. Impact console.log(result.toString()); // Outputs "Hello" followed by the contents of the PATH environment variable ``` ### Patches This bug has been patched in [v1.7.1](https://github.com/ericcornelissen/shescape/releases/tag/v1.7.1) which you can upgrade to now. No further changes are required. ### Workarounds Alternatively, users can remove all instances of `%` from user input, either before or after using Shescape. ### References - Shescape Pull request [#982](https://github.com/ericcornelissen/shescape/pull/982) - Shescape commit [`d0fce70`](https://github.com/ericcornelissen/shescape/commit/d0fce70f987ac0d8331f93cb45d47e79436173ac) - Shescape Release [v1.7.1](https://github.com/ericcornelissen/shescape/releases/tag/v1.7.1)

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "*",
  "versionEndExcluding": "1.7.1"
}

CVSS: оценки и векторы

Оценка CVSS отсутствует.

Источники и ссылки

{
  "cwes": [],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-04T21:06:47.846366+00:00"
  },
  "title": {
    "source": "osv",
    "received_at": "2026-11-02T12:13:11.204591+00:00"
  },
  "scores": [],
  "affected": [
    "osv"
  ],
  "published": {
    "source": "osv",
    "received_at": "2026-11-02T12:13:11.204591+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-04T21:06:47.846366+00:00"
  },
  "references": [
    "osv"
  ],
  "description": {
    "source": "osv",
    "received_at": "2026-11-02T12:13:11.204591+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены05.11.2026, 00:06
2. Данные обновлены04.11.2026, 00:06
3. Данные обновлены03.11.2026, 00:06
4. Опубликована02.11.2026, 15:13

Личная заметка и статус

Другие CVE того же продукта