CVE-2026-30916
NoneCVSS
—
EPSS
—
Published
Mar 10, 2026
CISA due date
—
The record
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: Further investigation determined that the software behavior described did not falls within the project's threat model. See https://github.com/github/advisory-database/pull/7206 for more information.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | shescape | 0 | 2.1.9 |
Related vulnerabilities
- GHSA-6f6w-6j58-rq76 Withdrawn Advisory: Shescape has possible misidentification of shell due to link chains Same vulnerability
- CVE-2026-32094 Shescape is a simple shell escape library for JavaScript. Also affects shescape
- GHSA-9jfh-9xrq-4vwm Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash Also affects shescape