How many CVEs have a located fix in ericcornelissen/shescape?

15 published CVEs have a fix traced to functions in ericcornelissen/shescape, touching 22 functions across 16 files.

Which function in ericcornelissen/shescape has been patched by the most CVEs?

replace in src/unix.js has been changed by 4 CVE fixes, from 2022 to 2022.

How large is a typical CVE fix in ericcornelissen/shescape?

The median fix changes 26 lines. 40% of fixes change 20 lines or fewer, and 27% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

javascript

#381 of 500 repositories

ericcornelissen/shescape

Name: ericcornelissen/shescape: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix August 15, 2026

15

CVE fixes located

Published CVEs

22

Functions patched

Distinct function sites

16

Files patched

Distinct source files

2021–2026

Years covered

By CVE publication date

Overview

15 published CVEs have a fix traced to functions in ericcornelissen/shescape, the earliest published in 2021. Those fixes changed 22 distinct functions across 16 files, in 91 patch hunks.

Among the 500 repositories tracked here, ericcornelissen/shescape ranks #381 by the number of CVEs with a located fix.

Most patched functions

Functions in ericcornelissen/shescape changed by the most CVE fixes.

Most patched files

Files in ericcornelissen/shescape changed by the most CVE fixes.

1src/unix.js7 CVEs · 4 functions
2src/win.js5 CVEs · 4 functions
3src/internal/unix/dash.js5 CVEs · 2 functions
4src/internal/win/cmd.js5 CVEs · 2 functions
5src/internal/unix/zsh.js4 CVEs · 2 functions
6src/internal/compose.js4 CVEs · 1 functions
7config/eslint.js4 CVEs · 0 functions
8src/internal/unix/busybox.js2 CVEs · 1 functions
9index.js1 CVEs · 2 functions
10src/executables.js1 CVEs · 1 functions

Fix size

How much code a CVE fix in ericcornelissen/shescape changes, with backports counted once.

26

Median lines changed

Added plus removed, per CVE

40%

Fixes of 20 lines or fewer

Share of CVE fixes

27%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in ericcornelissen/shescape, and the functions each fix changed.

Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox
CVE-2026-73055getEscapeFunction
Medium · CVSS 6.3
EPSS 0.4%2026-08-15
Shescape: Shell injection via unescaped parentheses on Windows with CMD
CVE-2026-73414compose replace replaceAll
Critical · CVSS 9.2
EPSS 0.9%2026-08-12
Shescape: Quadratic-time denial of service in flag-protection
CVE-2026-73413compose replace replaceAll
High · CVSS 8.7
EPSS 0.6%2026-08-12
Shescape: Path disclosure on Unix with Zsh
CVE-2026-73412compose replace replaceAll
Medium · CVSS 6.3
EPSS 0.6%2026-08-12
Shescape: Home-directory disclosure in assignment context on Unix with Dash
CVE-2026-73411compose replace replaceAll
Medium · CVSS 6.3
EPSS 0.6%2026-08-12
Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash
CVE-2026-32094getEscapeFunction replace
Medium · CVSS 6.9
EPSS 0.3%2026-03-11
Shescape has potential environment variable exposure on Windows with CMD
CVE-2025-30222split
Low · CVSS 2.1
EPSS 0.2%2025-03-25
Shescape on Windows escaping may be bypassed in threaded context
CVE-2023-40185getShellName resolveExecutable parseOptions
High · CVSS 8.6
EPSS 0.7%2023-08-23
Shescape potential environment variable exposure on Windows with CMD
CVE-2023-35931replace
Medium · CVSS 4.3
EPSS 0.8%2023-06-23
Inefficient Regular Expression Complexity in shescape
CVE-2022-25918replace
High · CVSS 7.5
EPSS 1.4%2022-10-27
CVE-2022-36064
CVE-2022-36064replace
High · CVSS 7.5
EPSS 1.4%2022-09-06
Shescape prior to 1.5.8 vulnerable to insufficient escaping of line feeds for CMD
CVE-2022-31179replace escapeArgCmd
Critical · CVSS 9.8
EPSS 1.4%2022-08-01

Get an alert for each new ericcornelissen/shescape CVE, with the patched functions and AI-written analysis.

Monitor shescape CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

0xJacky/nginx-ui15 CVEs apache/mynewt-nimble15 CVEs cubecart/v615 CVEs debian/busybox15 CVEs debian/libsoup315 CVEs debian/zziplib15 CVEs decolua/9router15 CVEs DSpace/DSpace15 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in ericcornelissen/shescape.

How many CVEs have a located fix in ericcornelissen/shescape?: 15 published CVEs have a fix traced to functions in ericcornelissen/shescape, touching 22 functions across 16 files.
Which function in ericcornelissen/shescape has been patched by the most CVEs?: replace in src/unix.js has been changed by 4 CVE fixes, from 2022 to 2022.
How large is a typical CVE fix in ericcornelissen/shescape?: The median fix changes 26 lines. 40% of fixes change 20 lines or fewer, and 27% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track ericcornelissen/shescape CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing