Vulnerability-Lookup

CVE-2025-30222 (GCVE-0-2025-30222)

Vulnerability from cvelistv5 – Published: 2025-03-25 23:00 – Updated: 2025-03-26 13:30

Title

Shescape has potential environment variable exposure on Windows with CMD

Summary

Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure `shell: 'cmd.exe'` or `shell: true` using any of `quote`/`quoteAll`/`escape`/`escapeAll`. An attacker may be able to get read-only access to environment variables. This bug has been patched in v2.1.2. For those who are already using v2 of Shescape, no further changes are required. Those who are are using v1 of Shescape should follow the migration guide to upgrade to v2. There is no plan to release a patch compatible with v1 of Shescape. As a workaround, users can remove all instances of `%` from user input before using Shescape.

Severity ?

2.1 (Low)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

URL

Tags

	https://github.com/ericcornelissen/shescape/secur…	x_refsource_CONFIRM
	https://github.com/ericcornelissen/shescape/pull/1916	x_refsource_MISC
	https://github.com/ericcornelissen/shescape/commi…	x_refsource_MISC
	https://github.com/ericcornelissen/shescape/relea…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	ericcornelissen	shescape	Affected: >= 1.7.2, < 2.1.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30222",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-26T13:30:30.955097Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-26T13:30:34.363Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shescape",
          "vendor": "ericcornelissen",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.7.2, \u003c 2.1.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure `shell: \u0027cmd.exe\u0027` or `shell: true` using any of `quote`/`quoteAll`/`escape`/`escapeAll`. An attacker may be able to get read-only access to environment variables. This bug has been patched in v2.1.2. For those who are already using v2 of Shescape, no further changes are required. Those who are are using v1 of Shescape should follow the migration guide to upgrade to v2. There is no plan to release a patch compatible with v1 of Shescape. As a workaround, users can remove all instances of `%` from user input before using Shescape."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-25T23:00:08.995Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j"
        },
        {
          "name": "https://github.com/ericcornelissen/shescape/pull/1916",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ericcornelissen/shescape/pull/1916"
        },
        {
          "name": "https://github.com/ericcornelissen/shescape/commit/0a81f1eb077bab8caae283a2490cd7be9af179c6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ericcornelissen/shescape/commit/0a81f1eb077bab8caae283a2490cd7be9af179c6"
        },
        {
          "name": "https://github.com/ericcornelissen/shescape/releases/tag/v2.1.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ericcornelissen/shescape/releases/tag/v2.1.2"
        }
      ],
      "source": {
        "advisory": "GHSA-66pp-5p9w-q87j",
        "discovery": "UNKNOWN"
      },
      "title": "Shescape has potential environment variable exposure on Windows with CMD"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-30222",
    "datePublished": "2025-03-25T23:00:08.995Z",
    "dateReserved": "2025-03-18T18:15:13.851Z",
    "dateUpdated": "2025-03-26T13:30:34.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-30222\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-26T13:30:30.955097Z\"}}}], \"references\": [{\"url\": \"https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-26T13:30:26.665Z\"}}], \"cna\": {\"title\": \"Shescape has potential environment variable exposure on Windows with CMD\", \"source\": {\"advisory\": \"GHSA-66pp-5p9w-q87j\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 2.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"ericcornelissen\", \"product\": \"shescape\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.7.2, \u003c 2.1.2\"}]}], \"references\": [{\"url\": \"https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j\", \"name\": \"https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/ericcornelissen/shescape/pull/1916\", \"name\": \"https://github.com/ericcornelissen/shescape/pull/1916\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/ericcornelissen/shescape/commit/0a81f1eb077bab8caae283a2490cd7be9af179c6\", \"name\": \"https://github.com/ericcornelissen/shescape/commit/0a81f1eb077bab8caae283a2490cd7be9af179c6\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/ericcornelissen/shescape/releases/tag/v2.1.2\", \"name\": \"https://github.com/ericcornelissen/shescape/releases/tag/v2.1.2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure `shell: \u0027cmd.exe\u0027` or `shell: true` using any of `quote`/`quoteAll`/`escape`/`escapeAll`. An attacker may be able to get read-only access to environment variables. This bug has been patched in v2.1.2. For those who are already using v2 of Shescape, no further changes are required. Those who are are using v1 of Shescape should follow the migration guide to upgrade to v2. There is no plan to release a patch compatible with v1 of Shescape. As a workaround, users can remove all instances of `%` from user input before using Shescape.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-03-25T23:00:08.995Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-30222\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-26T13:30:34.363Z\", \"dateReserved\": \"2025-03-18T18:15:13.851Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-03-25T23:00:08.995Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-66PP-5P9W-Q87J

Vulnerability from github – Published: 2025-03-26 14:54 – Updated: 2025-03-26 14:54

Summary

Shescape has potential environment variable exposure on Windows with CMD

Details

Impact

This impact users of Shescape on Windows that explicitly configure shell: 'cmd.exe' or shell: true using any of quote/quoteAll/escape/escapeAll.

An attacker may be able to get read-only access to environment variables. Example:

import * as cp from "node:child_process";
import { Shescape } from "shescape";

// 1. Prerequisites
const shescape = new Shescape({
    shell: "cmd.exe",
    // Or
    shell: true, // Only if the default shell is CMD
});

// 2. Payload
const payload = '"%PATH%';

// 3. Usage
let escapedPayload;

escapedPayload = shescape.quote(payload);
// Or
escapedPayload = shescape.quoteAll([payload]);
// Or
escapedPayload = shescape.escape(payload);
// Or
escapedPayload = shescape.escapeAll([payload]);

// And (example)
const result = cp.execSync(`echo Hello ${escapedPayload}`, options);

// 4. Impact
console.log(result.toString());
// Outputs "Hello" followed by the contents of the PATH environment variable

For Shescape prior to v2.0.0, the options object must have shell: 'cmd.exe' or shell: undefined and interpolation: true.

Patches

This bug has been patched in v2.1.2 which you can upgrade to now.

If you are already using v2 of Shescape, no further changes are required. If you are using v1 of Shescape, follow the migration guide to upgrade to v2. There is no plan to release a patch compatible with v1 of Shescape.

Workarounds

Alternatively, users can remove all instances of % from user input before using Shescape.

References

Shescape Pull Request #1916
Shescape commit 0a81f1e
Shescape release v2.1.2

For more information

Comment on Pull Request #1916
Comment on commit 0a81f1e
Open an issue at https://github.com/ericcornelissen/shescape/issues (New issue > Question)

Severity ?

2.1 (Low)


                  
                    CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "shescape"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.2"
            },
            {
              "fixed": "2.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-30222"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-26T14:54:22Z",
    "nvd_published_at": "2025-03-25T23:15:36Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nThis impact users of Shescape on Windows that explicitly configure `shell: \u0027cmd.exe\u0027` or `shell: true` using any of `quote`/`quoteAll`/`escape`/`escapeAll`.\n\nAn attacker may be able to get read-only access to environment variables. Example:\n\n```javascript\nimport * as cp from \"node:child_process\";\nimport { Shescape } from \"shescape\";\n\n// 1. Prerequisites\nconst shescape = new Shescape({\n    shell: \"cmd.exe\",\n    // Or\n    shell: true, // Only if the default shell is CMD\n});\n\n// 2. Payload\nconst payload = \u0027\"%PATH%\u0027;\n\n// 3. Usage\nlet escapedPayload;\n\nescapedPayload = shescape.quote(payload);\n// Or\nescapedPayload = shescape.quoteAll([payload]);\n// Or\nescapedPayload = shescape.escape(payload);\n// Or\nescapedPayload = shescape.escapeAll([payload]);\n\n// And (example)\nconst result = cp.execSync(`echo Hello ${escapedPayload}`, options);\n\n// 4. Impact\nconsole.log(result.toString());\n// Outputs \"Hello\" followed by the contents of the PATH environment variable\n```\n\nFor Shescape prior to v2.0.0, the `options` object must have `shell: \u0027cmd.exe\u0027` or `shell: undefined` and `interpolation: true`.\n\n\n### Patches\n\nThis bug has been patched in [v2.1.2](https://github.com/ericcornelissen/shescape/releases/tag/v2.1.2) which you can upgrade to now.\n\nIf you are already using v2 of Shescape, no further changes are required. If you are using v1 of Shescape, follow the [migration guide](https://github.com/ericcornelissen/shescape/blob/155b13b4141750203ce71249f1b0fdc638c7a0d0/docs/migration.md) to upgrade to v2. There is no plan to release a patch compatible with v1 of Shescape.\n\n\n### Workarounds\n\nAlternatively, users can remove all instances of % from user input before using Shescape.\n\n\n### References\n\n- Shescape Pull Request [#1916](https://github.com/ericcornelissen/shescape/pull/1916)\n- Shescape commit [0a81f1e](https://github.com/ericcornelissen/shescape/commit/0a81f1eb077bab8caae283a2490cd7be9af179c6)\n- Shescape release [v2.1.2](https://github.com/ericcornelissen/shescape/releases/tag/v2.1.2)\n\n\n### For more information\n\n- Comment on Pull Request [#1916](https://github.com/ericcornelissen/shescape/pull/1916)\n- Comment on commit [0a81f1e](https://github.com/ericcornelissen/shescape/commit/0a81f1eb077bab8caae283a2490cd7be9af179c6)\n- Open an issue at [https://github.com/ericcornelissen/shescape/issues](https://github.com/ericcornelissen/shescape/issues) (New issue \u003e Question)",
  "id": "GHSA-66pp-5p9w-q87j",
  "modified": "2025-03-26T14:54:22Z",
  "published": "2025-03-26T14:54:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30222"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ericcornelissen/shescape/pull/1916"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ericcornelissen/shescape/commit/0a81f1eb077bab8caae283a2490cd7be9af179c6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ericcornelissen/shescape"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ericcornelissen/shescape/releases/tag/v2.1.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Shescape has potential environment variable exposure on Windows with CMD"
}

FKIE_CVE-2025-30222

Vulnerability from fkie_nvd - Published: 2025-03-25 23:15 - Updated: 2025-03-27 16:45

Severity ?

2.1 (Low) - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/ericcornelissen/shescape/commit/0a81f1eb077bab8caae283a2490cd7be9af179c6
	security-advisories@github.com	https://github.com/ericcornelissen/shescape/pull/1916
	security-advisories@github.com	https://github.com/ericcornelissen/shescape/releases/tag/v2.1.2
	security-advisories@github.com	https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure `shell: \u0027cmd.exe\u0027` or `shell: true` using any of `quote`/`quoteAll`/`escape`/`escapeAll`. An attacker may be able to get read-only access to environment variables. This bug has been patched in v2.1.2. For those who are already using v2 of Shescape, no further changes are required. Those who are are using v1 of Shescape should follow the migration guide to upgrade to v2. There is no plan to release a patch compatible with v1 of Shescape. As a workaround, users can remove all instances of `%` from user input before using Shescape."
    },
    {
      "lang": "es",
      "value": "Shescape es una librer\u00eda de escape de shell sencilla para JavaScript. Las versiones 1.7.2 a 2.1.1 son vulnerables a la posible exposici\u00f3n de variables de entorno en Windows con CMD. Esto afecta a los usuarios de Shescape en Windows que configuran expl\u00edcitamente `shell: \u0027cmd.exe\u0027` o `shell: true` mediante `quote`/`quoteAll`/`escape`/`escapeAll`. Un atacante podr\u00eda obtener acceso de solo lectura a las variables de entorno. Este error se ha corregido en la versi\u00f3n 2.1.2. Quienes ya utilizan la versi\u00f3n 2 de Shescape no requieren cambios adicionales. Quienes utilizan la versi\u00f3n 1 de Shescape deben seguir la gu\u00eda de migraci\u00f3n para actualizar a la versi\u00f3n 2. No se prev\u00e9 publicar un parche compatible con la versi\u00f3n 1 de Shescape. Como workaround, los usuarios pueden eliminar todas las instancias de `%` de la entrada de usuario antes de usar Shescape."
    }
  ],
  "id": "CVE-2025-30222",
  "lastModified": "2025-03-27T16:45:46.410",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.1,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "UNREPORTED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-03-25T23:15:36.707",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ericcornelissen/shescape/commit/0a81f1eb077bab8caae283a2490cd7be9af179c6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ericcornelissen/shescape/pull/1916"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ericcornelissen/shescape/releases/tag/v2.1.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-66pp-5p9w-q87j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-30222 (GCVE-0-2025-30222)

GHSA-66PP-5P9W-Q87J

Impact

Patches

Workarounds

References

For more information

FKIE_CVE-2025-30222

Tags

Sightings

Nomenclature