CVE-2023-35931

LOW3.1

Shescape potential environment variable exposure on Windows with CMD

Published Jun 23, 2023

Modified 1 years ago

Details

Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1.

References

WEB

https://github.com/ericcornelissen/shescape/commit/d0fce70f987ac0d8331f93cb45d47e79436173ac

WEB

https://github.com/ericcornelissen/shescape/pull/982

WEB

https://github.com/ericcornelissen/shescape/releases/tag/v1.7.1

WEB

https://github.com/ericcornelissen/shescape/security/advisories/GHSA-3g7p-8qhx-mc8r

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2023-35931

CVSS Analysis

CVSS v3.1

3.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

NoneI:N

Availability

NoneA:N

3.1/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness Type (CWE)

Other

CWE-526

Ecosystems

Timeline

PublishedJun 23, 2023

ModifiedDec 5, 2024

CVE-2023-35931 | Mondoo Vulnerability Intelligence