How severe is CVE-2022-31179?

CVE-2022-31179 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability high.

Is CVE-2022-31179 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (62nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-31179?

CVE-2022-31179 affects Shescape Project Shescape. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-31179?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2022-31179 published?

CVE-2022-31179 was published on 2022-08-01 and last updated on 2026-06-17.

CVE-2022-31179

CVE-2022-31179 is a high-severity vulnerability in Shescape Project Shescape with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-74.

Key facts

Severity: High (CVSS 3.x base score 8.1)
EPSS exploit prediction: 1% (62nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-74
Affected product: Shescape Project Shescape
Published: 2022-08-01
Last modified: 2026-06-17

Description

Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows An attacker can omit all arguments following their input by including a line feed character (`'\n'`) in the payload. This bug has been patched in [v1.5.8] which you can upgrade to now. No further changes are required. Alternatively, line feed characters (`'\n'`) can be stripped out manually or the user input can be made the last argument (this only limits the impact).

Frequently asked questions

What is CVE-2022-31179?: Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows An attacker can omit all arguments following their input by including a line feed character (`'\n'`) in the payload. This bug has been patched in [v1.5.8] which you can upgrade to now. No further changes are required. Alternatively, line feed characters (`'\n'`) can be stripped out manually or the user input can be made the last argument (this only limits the impact).
How severe is CVE-2022-31179?: CVE-2022-31179 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability high.
Is CVE-2022-31179 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (62nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-31179?: CVE-2022-31179 affects Shescape Project Shescape. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-31179?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2022-31179 published?: CVE-2022-31179 was published on 2022-08-01 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:shescape_project:shescape:*:*:*:*:*:*:*:*

More vulnerabilities in Shescape Project Shescape

CVE-2022-31180 — Critical (CVSS 9.8): Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of…
CVE-2026-32094 — Medium (CVSS 6.5): Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape…
CVE-2023-40185 — Medium (CVSS 6.5): shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a…
CVE-2021-21384 — Medium (CVSS 6.3): shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to…
CVE-2022-24725 — Medium (CVSS 6.2): Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home…
CVE-2022-36064 — Medium (CVSS 5.9): Shescape is a shell escape package for JavaScript. An Inefficient Regular Expression Complexity vulnerability impacts…

All CVEs affecting Shescape Project Shescape →

Other CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities

CVE-2026-25586 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty…
CVE-2026-25520 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped.…
CVE-2025-20265 — Critical (CVSS 10.0): A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could…
CVE-2025-20337 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
CVE-2025-20281 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
CVE-2024-42472 — Critical (CVSS 10.0): Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious…

Browse all CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities →