Detections
Analytics

SCA: security update for shescape (GHSA-gm3r-q2wp-hw87)

high Tenable Self-Hosted Container Security Plugin ID 445914

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-
 protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when
 flagProtection is enabled, which is the default, making processing quadratic in input size across the
 escape, escapeAll, quote, and quoteAll APIs. An attacker who can supply a large untrusted input containing
 many flag fragments can consume CPU and cause denial of service. This issue is fixed in versions 2.1.14
 and 3.0.1. (CVE-2026-73413)

Solution

Update the shescape library and its related packages to version 2.1.14 or later.

See Also

https://github.com/advisories/GHSA-gm3r-q2wp-hw87

Plugin Details

Severity: High

ID: 445914

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/13/2026

Updated: 8/13/2026

Risk Information

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-73413

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/24/2026

Vulnerability Publication Date: 7/24/2026

Reference Information

CVE: CVE-2026-73413