Is CVE-2026-30916 actively exploited?

No active exploitation of CVE-2026-30916 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-30916 be exploited remotely?

Yes. CVE-2026-30916 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-30916?

CVE-2026-30916 has a CVSS score of 2.9 (LOW).

HOME VULNERABILITIESCVE-2026-30916

LOW

CVE-2026-30916

CWE-200Published: March 10, 2026· Updated: Mar 11, 2026

2.9

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:11.8th

Official Description

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.9, an attacker may be able to bypass escaping for the shell being used. This can result, for example, in exposure of sensitive information. This impacts users of Shescape that configure their shell to point to a file on disk that is a link to a link. The precise result of being affected depends on the actual shell used and incorrect shell identified by Shescape. This vulnerability is fixed in 2.1.9.

NVD Source

Technical Analysis

CVE-2026-30916 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X