by Kastro
Paper/Archive/CVE-2026-73414

CVE-2026-73414

ericcornelissen shescape — Shescape: Shell injection via unescaped parentheses on Windows with CMD

EPSS 0.9%CVSS 9.2
critical.is priorityof 100
40
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 59.4.594 × 2011.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An attacker-controlled argument can break out of a parenthesized CMD construct and inject shell syntax depending on the original command, resulting in arbitrary command execution. This issue is fixed in versions 2.1.14 and 3.0.1.

Affected

ProductAffectedFixed inSource
shescape< 2.1.14–CNA
shescape>= 3.0.0, < 3.0.1–CNA

Scores by source

GitHub_M (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/ericcornelissen/shescape/security/advisories/GHSA-w4hw-qcx7-56prrefgithub.com/ericcornelissen/shescape/pull/2649refgithub.com/ericcornelissen/shescape/pull/2651refgithub.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9derefgithub.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425frefgithub.com/ericcornelissen/shescape/releases/tag/v2.1.14refgithub.com/ericcornelissen/shescape/releases/tag/v3.0.1