Shescape’s escape() function, before version 2.1.10, fails to escape square‑bracket glob syntax for Bash, BusyBox sh, and Dash. Because an attacker can supply a string such as secret[12] that is passed directly into a shell command, the shell performs glob expansion and replaces the token with multiple filesystem matches instead of a single literal argument. This results in unintended disclosure of filename information or presence of files. The nature of the weakness aligns with CWE‑200 Information Exposure. The primary impact, while not allowing arbitrary code execution, is that an attacker can learn sensitive filesystem details from the target environment. This impact is inferred from the description; the CVE itself does not state a direct data leak but the mechanics of glob expansion suggest information exposure.

The flaw affects the shescape JavaScript library in all releases prior to 2.1.10. The affected CPE is cpe:2.3:a:shescape_project:shescape:*:*:*:*:*:node.js:*:* . Any Node.js application that uses shescape’s escape() function to build shell command strings and then executes those commands is vulnerable. The weakness does not arise from the shell itself, but from the improper escaping performed by the library when later interpreted by Bash, BusyBox sh, or Dash.

The CVSS score of 6.9 indicates medium severity. An EPSS score of less than 1% suggests very low likelihood of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require that an attacker can provide untrusted input to escape() and that the application unconditionally runs the resulting string through a shell interpreter; typical paths could involve local or remote injection of data that reaches the escape() call. Because the vulnerability only causes accidental glob expansion and does not grant arbitrary command execution, the exploitable damage is limited to information disclosure and potential misuse of trusted paths, but the risk remains significant for applications handling sensitive data.