CVE-2026-73413: Shescape: Quadratic-time denial of service in flag-protection
Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size across the escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14 and 3.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Shescapeto a version that resolves this vulnerability.Fixed in 2.1.14 - Upgrade
Upgrade
Shescapeto a version that resolves this vulnerability.Fixed in 3.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73413?
CVE-2026-73413 has a risk score of 29, indicating a potential vulnerability that may lead to denial of service.
How do I fix CVE-2026-73413?
To fix CVE-2026-73413, update Shescape to version 2.1.15 or later, or 3.0.2 or later.
What versions of Shescape are affected by CVE-2026-73413?
CVE-2026-73413 affects Shescape versions 2.1.11 through 2.1.14 and version 3.0.1.
What type of vulnerability is CVE-2026-73413?
CVE-2026-73413 is a quadratic-time denial of service vulnerability that affects the flag-protection feature in Shescape.
Is CVE-2026-73413 a critical vulnerability?
While CVE-2026-73413 is not rated as critical, its quadratic nature can lead to significant performance degradation under certain conditions.