CVE-2026-73412

Received Received - Intake

Path Traversal in Shescape via Zsh Glob Patterns

Publication date: 2026-08-12

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used to leak more information. This issue is fixed in versions 2.1.14 and 3.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-13

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73412

EUVD

EUVD-2026-57525

Affected Vendors & Products

Vendor	Product	Version / Range
shescape	shescape	to 2.1.14\|end_excluding=3.0.1 (exc)
ericcornelissen	shescape	to 3.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-155	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as wildcards or matching symbols when they are sent to a downstream component.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-73412 is a vulnerability in the Shescape library for JavaScript. It affects Unix systems using Zsh as the shell when users explicitly configure Zsh or when Zsh is the default shell. The issue occurs when using the escape or escapeAll functions. The Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST worsen the problem by allowing attackers to exploit home directory expansion and extended glob syntax to list files and directories on the system. This can lead to information leakage depending on the command's behavior.

Detection Guidance

To detect this vulnerability, check if your system uses Zsh as the default shell and if Shescape versions prior to 2.1.14 or 3.0.1 are installed. Inspect Zsh configuration files like .zshrc for enabled options EXTENDED_GLOB or MAGIC_EQUAL_SUBST. Test with payloads like :~ or a=~ in commands using Shescape's escape functions to see if directory listings are exposed.

Impact Analysis

An attacker could exploit this vulnerability to obtain lists of files and directories on your system. This may result in the disclosure of sensitive information, depending on what the command does. For example, an attacker could use payloads like :~ or a=~ (with MAGIC_EQUAL_SUBST) to reveal your home directory contents or use EXTENDED_GLOB to expose specific files.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Information leakage from file system access could result in non-compliance with these regulations, potentially leading to legal or financial penalties.

Mitigation Strategies

Immediately update Shescape to versions 2.1.14 or 3.0.1 or later. Avoid using Zsh as the shell if possible. Disable Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST in your configuration files. Sanitize all untrusted inputs passed to Shescape functions to prevent path expansion exploits.

Hi! I’m here to help you understand CVE-2026-73412. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70