CVE-2026-73413

Name of the Vulnerable Software and Affected Versions Shescape versions 2.1.11 through 2.1.13 Shescape version 3.0.0

Description A flaw exists in the flag-protection loop within the compose function in src/internal/compose.js. When flagProtection is enabled, the system repeatedly joins and slices flag fragments, resulting in quadratic processing time relative to the input size. This affects the escape, escapeAll, quote, and quoteAll APIs. An attacker providing large untrusted input with numerous flag fragments can cause excessive CPU consumption, leading to a denial of service.

Recommendations Update to version 2.1.14. Update to version 3.0.1.