Shescape: Shell injection via unescaped parentheses on Windows with CMD
Shescape versions prior to 2.1.14 and versions 3.0.0 up to but not including 3.0.1 on Windows using CMD shell are vulnerable to shell injection via unescaped parentheses. This occurs when using the escape or escapeAll APIs with CMD shell, allowing an attacker to inject commands by exploiting unescaped parentheses in input. The vulnerability has been patched in versions 2.1.14 and 3.0.1. Users are advised to upgrade to these versions or remove parentheses from untrusted inputs as a workaround.
AI Analysis
Technical Summary
The Shescape library on Windows configured to use CMD shell (explicitly or by default) is vulnerable to shell injection due to improper escaping of parentheses characters when using the escape and escapeAll APIs. An attacker can craft input containing parentheses to alter command execution flow, as demonstrated by injecting a conditional command that executes unexpectedly. This vulnerability affects versions prior to 2.1.14 and versions from 3.0.0 up to but excluding 3.0.1. The issue is fixed in Shescape v2.1.14 and v3.0.1. No patches are available for versions below 2.0.0. Users of v2 are encouraged to upgrade to v3, which is maintained beyond 2026-09-28.
Potential Impact
Successful exploitation allows an attacker to perform shell injection on Windows CMD shell environments when using Shescape's escape functions, potentially executing arbitrary commands. This can lead to unauthorized command execution within the context of the affected application. The vulnerability is critical due to the possibility of remote code execution without user interaction or privileges.
Mitigation Recommendations
Upgrade Shescape to version 2.1.14 or later in the v2 branch, or to version 3.0.1 or later in the v3 branch, where this vulnerability is patched. If upgrading is not immediately possible, remove all instances of '(' and ')' characters from untrusted inputs to prevent injection. No patches will be released for versions below 2.0.0, so upgrading is the recommended long-term solution.
Shescape: Shell injection via unescaped parentheses on Windows with CMD
Description
Shescape versions prior to 2.1.14 and versions 3.0.0 up to but not including 3.0.1 on Windows using CMD shell are vulnerable to shell injection via unescaped parentheses. This occurs when using the escape or escapeAll APIs with CMD shell, allowing an attacker to inject commands by exploiting unescaped parentheses in input. The vulnerability has been patched in versions 2.1.14 and 3.0.1. Users are advised to upgrade to these versions or remove parentheses from untrusted inputs as a workaround.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Shescape library on Windows configured to use CMD shell (explicitly or by default) is vulnerable to shell injection due to improper escaping of parentheses characters when using the escape and escapeAll APIs. An attacker can craft input containing parentheses to alter command execution flow, as demonstrated by injecting a conditional command that executes unexpectedly. This vulnerability affects versions prior to 2.1.14 and versions from 3.0.0 up to but excluding 3.0.1. The issue is fixed in Shescape v2.1.14 and v3.0.1. No patches are available for versions below 2.0.0. Users of v2 are encouraged to upgrade to v3, which is maintained beyond 2026-09-28.
Potential Impact
Successful exploitation allows an attacker to perform shell injection on Windows CMD shell environments when using Shescape's escape functions, potentially executing arbitrary commands. This can lead to unauthorized command execution within the context of the affected application. The vulnerability is critical due to the possibility of remote code execution without user interaction or privileges.
Mitigation Recommendations
Upgrade Shescape to version 2.1.14 or later in the v2 branch, or to version 3.0.1 or later in the v3 branch, where this vulnerability is patched. If upgrading is not immediately possible, remove all instances of '(' and ')' characters from untrusted inputs to prevent injection. No patches will be released for versions below 2.0.0, so upgrading is the recommended long-term solution.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-w4hw-qcx7-56pr
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 4.0
Threat ID: 6a6542199c2644c7f8087e64
Added to database: 07/25/2026, 23:09:13 UTC
Last enriched: 07/25/2026, 23:49:55 UTC
Last updated: 07/26/2026, 03:42:33 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.