Threats tagged 'osec-2026-24'

Multiple command quoting issues were identified in OCaml on Windows platforms affecting the Filename.quote_command and Unix.create_process* functions. These issues could allow unsafe argument quoting or injection when invoking .bat or .cmd scripts with certain metacharacters. The vulnerability affects various OCaml versions prior to 4.14.5 and between 5.0.0 and 5.5.1, as well as specific 3.x releases. A fix has been merged that improves argument quoting and rejects unsafe arguments by raising an exception.