CVE-2026-73412: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ericcornelissen shescape
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used to leak more information. This issue is fixed in versions 2.1.14 and 3.0.1.
AI Analysis
Technical Summary
Shescape is a shell escape library for JavaScript. Versions before 2.1.14 and 3.0.1 are vulnerable on Unix systems using Zsh shell, especially with EXTENDED_GLOB and MAGIC_EQUAL_SUBST options enabled. The vulnerability allows attackers to leverage home directory expansion and extended glob syntax to obtain file and directory listings, which may lead to information disclosure. This is an OS command injection vulnerability (CWE-78) related to improper neutralization of special elements in OS commands. The vulnerability is resolved in versions 2.1.14 and 3.0.1.
Potential Impact
An attacker can exploit this vulnerability to obtain lists of files and directories on affected systems, potentially leading to information disclosure. The impact depends on the commands executed using the library. There is no indication of privilege escalation or remote code execution beyond information leakage. No known exploits are reported in the wild.
Mitigation Recommendations
This vulnerability is fixed in Shescape versions 2.1.14 and 3.0.1. Users should upgrade to these or later versions to remediate the issue. No official vendor advisory is provided, so patch status is inferred from the description. Patch status is not yet confirmed by a vendor advisory — check the vendor repository or official channels for current remediation guidance.
CVE-2026-73412: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ericcornelissen shescape
Description
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used to leak more information. This issue is fixed in versions 2.1.14 and 3.0.1.
CVSS v4.0
Score 6.3medium
Affected software
ericcornelissen
shescape
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Shescape is a shell escape library for JavaScript. Versions before 2.1.14 and 3.0.1 are vulnerable on Unix systems using Zsh shell, especially with EXTENDED_GLOB and MAGIC_EQUAL_SUBST options enabled. The vulnerability allows attackers to leverage home directory expansion and extended glob syntax to obtain file and directory listings, which may lead to information disclosure. This is an OS command injection vulnerability (CWE-78) related to improper neutralization of special elements in OS commands. The vulnerability is resolved in versions 2.1.14 and 3.0.1.
Potential Impact
An attacker can exploit this vulnerability to obtain lists of files and directories on affected systems, potentially leading to information disclosure. The impact depends on the commands executed using the library. There is no indication of privilege escalation or remote code execution beyond information leakage. No known exploits are reported in the wild.
Mitigation Recommendations
This vulnerability is fixed in Shescape versions 2.1.14 and 3.0.1. Users should upgrade to these or later versions to remediate the issue. No official vendor advisory is provided, so patch status is inferred from the description. Patch status is not yet confirmed by a vendor advisory — check the vendor repository or official channels for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-12T14:32:11.795Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a7cd127bf8831d53911d103
Added to database: 08/12/2026, 20:01:43 UTC
Last enriched: 08/12/2026, 20:12:35 UTC
Last updated: 09/26/2026, 01:47:44 UTC
Views: 49
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.