{"action":"Upgrade shescape to 2.1.14 or later.","affected":[{"fixed":"2.1.14","introduced":"2.1.11"},{"fixed":"3.0.1","introduced":"3.0.0"}],"component":"shescape","cve_ids":["CVE-2026-73413"],"ecosystem":"npm","epss":0.0059,"exploited":false,"fixed_versions":["2.1.14","3.0.1"],"ghsa_id":"GHSA-gm3r-q2wp-hw87","id":"tcs_01M5KFS05B239NTRYXDZ0YBGBT","modified_at":"2026-08-12T19:59:13.755299Z","published_at":"2026-07-24T22:35:08Z","references":["https://osv.dev/vulnerability/GHSA-gm3r-q2wp-hw87","https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gm3r-q2wp-hw87","https://github.com/ericcornelissen/shescape/pull/2649","https://github.com/ericcornelissen/shescape/pull/2651","https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de","https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f","https://github.com/ericcornelissen/shescape","https://github.com/ericcornelissen/shescape/blob/dea8893a5877893d8d4923dbf253080e08899e6d/docs/migration.md","https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14","https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-gm3r-q2wp-hw87","url":"https://osv.dev/vulnerability/GHSA-gm3r-q2wp-hw87"}],"summary":"Shescape: Quadratic-time denial of service in the flag-protection"}