shescape has 4 CVEs on record. The busiest recent month was July 2026 with 4.
CVEs per month
Last 12 months, by publish date
1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- —
- Publish → KEV
- —
- Last 90 days
- 0 prev 4
4
Total CVEs
1
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
GHSA-w4hw-qcx7-56prCriticalShescape: Shell injection via unescaped parentheses on Windows with CMD52GHSA-gm3r-q2wp-hw87HighShescape: Quadratic-time denial of service in the flag-protection41GHSA-q53c-4prm-w95qMediumShescape: Home-directory disclosure in assignment context on Unix with Dash28GHSA-6v4m-fw66-8r4xMediumShescape: Path disclosure on Unix with Zsh28
shescape vulnerabilities
CVEs affecting shescape, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
GHSA-6v4m-fw66-8r4xMediumShescape: Path disclosure on Unix with Zsh
Shescape: Path disclosure on Unix with Zsh
▾ Sunlitshescape · shescapevia GHSA
GHSA-w4hw-qcx7-56prCriticalShescape: Shell injection via unescaped parentheses on Windows with CMD
Shescape: Shell injection via unescaped parentheses on Windows with CMD
▾ Midnightshescape · shescapevia GHSA
GHSA-q53c-4prm-w95qMediumShescape: Home-directory disclosure in assignment context on Unix with Dash
Shescape: Home-directory disclosure in assignment context on Unix with Dash
▾ Sunlitshescape · shescapevia GHSA
GHSA-gm3r-q2wp-hw87HighShescape: Quadratic-time denial of service in the flag-protection
Shescape: Quadratic-time denial of service in the flag-protection
▾ Twilightshescape · shescapevia GHSA