CVE-2023-40185

MediumCVSS 6.5

Published: 23/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

42th percentile - higher than 42% of all known CVEs

Summary

The vulnerability in the Shescape library for JavaScript may impact Windows users in a threaded context. It can lead to incorrect escaping for the wrong shell, allowing attackers to bypass protections.

Risk Assessment

Organizations using Shescape in Windows environments may be vulnerable to attacks that exploit improper protections in a threaded context.

Recommendation

It is recommended to update the Shescape library to version 1.7.4 to mitigate this vulnerability.

Original NVD description (English source)

shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell. This bug has been patched in version 1.7.4.