Threats tagged 'osec-2026-05'

A vulnerability in OCaml on Windows allows command injection via improper quoting of stdin/stdout/stderr filenames. The function Filename.quote_command does not sufficiently escape the '&' character, enabling an attacker to inject shell commands if they can control these file descriptors. This issue affects multiple OCaml versions prior to 4.14.4 and certain 5.x versions. A fix has been released in OCaml 4.14.4.