Critical severityNVD Advisory· Published Aug 12, 2026
CVE-2026-73414
CVE-2026-73414
Description
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape ( and ) when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An attacker-controlled argument can break out of a parenthesized CMD construct and inject shell syntax depending on the original command, resulting in arbitrary command execution. This issue is fixed in versions 2.1.14 and 3.0.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
shescapenpm | < 2.1.14 | 2.1.14 |
shescapenpm | >= 3.0.0, < 3.0.1 | 3.0.1 |
Affected products
1Patches
Vulnerability mechanics
References
9- github.com/advisories/GHSA-w4hw-qcx7-56prghsaADVISORY
- github.com/ericcornelissen/shescape/blob/dea8893a5877893d8d4923dbf253080e08899e6d/docs/migration.mdghsaWEB
- github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9denvdWEB
- github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425fnvdWEB
- github.com/ericcornelissen/shescape/pull/2649nvdWEB
- github.com/ericcornelissen/shescape/pull/2651nvdWEB
- github.com/ericcornelissen/shescape/releases/tag/v2.1.14nvdWEB
- github.com/ericcornelissen/shescape/releases/tag/v3.0.1nvdWEB
- github.com/ericcornelissen/shescape/security/advisories/GHSA-w4hw-qcx7-56prnvdWEB
News mentions
0No linked articles in our index yet.