Denial of Service Vulnerability in Shescape JavaScript Library
CVE-2026-73413
8.7HIGH
What is CVE-2026-73413?
The Shescape JavaScript library contains a vulnerability where the flag-protection loop in the compose function is inefficient due to excessive string manipulation. This issue arises in versions 2.1.11 through 2.1.14 and 3.0.1, causing non-linear performance when handling large untrusted inputs. Attackers can exploit this vulnerability by supplying specially crafted inputs, leading to significant CPU consumption and potential Denial of Service. Mitigations have been implemented in subsequent releases, ensuring better performance and security.
Affected Version(s)
shescape >= 2.1.11, < 2.1.14 < 2.1.11, 2.1.14
shescape >= 3.0.0, < 3.0.1 < 3.0.0, 3.0.1