CVE-2025-30222

Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure `shell: 'cmd.exe'` or `shell: true` using any of `quote`/`quoteAll`/`escape`/`escapeAll`. An attacker may be able to get read-only access to environment variables. This bug has been patched in v2.1.2. For those who are already using v2 of Shescape, no further changes are required. Those who are are using v1 of Shescape should follow the migration guide to upgrade to v2. There is no plan to release a patch compatible with v1 of Shescape. As a workaround, users can remove all instances of `%` from user input before using Shescape.

• CWE-200

• https://github.com/ericcornelissen/shescape/commit/0a81f1eb077bab8caae283a2490cd7be9af179c6
• https://github.com/ericcornelissen/shescape/pull/1916
• https://github.com/ericcornelissen/shescape/releases/tag/v2.1.2
• https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j
• https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j

Published

Mar 25, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30217Frappe is a full-stack web application framework. Prior to v…7.5
• CVE-2025-30218Next.js is a React framework for building full-stack web app…5.9
• CVE-2025-30219RabbitMQ is a messaging and streaming broker. Versions prior…6.1
• CVE-2025-3022Os command injection vulnerability in e-solutions e-manageme…9.3
• CVE-2025-30220GeoServer is an open source server that allows users to shar…9.1
• CVE-2025-30221Pitchfork is a preforking HTTP server for Rack applications.…4.3
• CVE-2025-30223Beego is an open-source web framework for the Go programming…9.6
• CVE-2025-30224MyDumper is a MySQL Logical Backup Tool. The MySQL C client …5.1
• CVE-2025-30225Directus is a real-time API and App dashboard for managing S…5.3
• CVE-2025-3023Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-30232A use-after-free in Exim 4.96 through 4.98.1 could allow use…7.8
• CVE-2025-30234SmartOS, as used in Triton Data Center and other products, h…8.3