Shescape, a lightweight JavaScript shell‑escape library, contains a quadratic‑time loop in its flag‑protection mechanism for the escape, escapeAll, quote, and quoteAll APIs. When flagProtection is enabled—the default state—the library repeatedly joins and slices flag fragments, resulting in CPU consumption that grows quadratically with input size. The flaw gives an attacker who can supply a large untrusted string containing numerous flag fragments the ability to exhaust processing resources and trigger a denial‑of‑service condition. This is a classic resource‑exhaustion weakness (CWE‑400, CWE‑407).

Affected product: shescape maintained by ericcornelissen. Versions 2.1.11 through 2.1.13 and any 3.0.x releases earlier than 3.0.1 are vulnerable. The vulnerability was patched in 2.1.14 and released as 3.0.1. All other existing releases prior to these fixes remain susceptible.

The CVSS score of 8.7 classifies the issue as high severity. No EPSS value is reported, so current exploit probability is unknown, but the lack of a KEV entry suggests no publicly observed exploitation yet. An attacker can trigger the defect by feeding a sufficiently large input to any component that uses the vulnerable shescape functions; local or remote exploitation is possible wherever untrusted data reaches these APIs. The attack does not require privileged access or a separate vulnerability; it simply consumes CPU resources to deny service.