Eric Cornelissen

The software is susceptible to Cross-site Scripting (XSS) through the `spin()` function. This allows an attacker to create multiple alerts for each 'target' element. Exploitation requires prototype pollution, achieved by setting an arbitrary key-value pair on `Object.prototype` via a crafted URL, enabling the execution of arbitrary JavaScript in the user's browser context.

Shescape is a JavaScript shell escape library. A flaw exists where an attacker may be able to bypass escaping for the shell being used, potentially leading to exposure of sensitive information. This issue impacts users who configure the `shell` option to point to a file on disk that is a symbolic link to another symbolic link. The outcome of a successful exploit depends on the specific shell in use and how Shescape identifies it. The provided proof of concept demonstrates the bypass using a crafted payload with the `userInput` variable and the `shescape.escape()` function. The example uses the `/api/v1/exec` endpoint to execute commands.