CVE-2026-73414

Received Received - Intake

Command Injection Vulnerability in Shescape JavaScript Library

Publication date: 2026-08-12

Last updated on: 2026-08-14

Assigner: GitHub, Inc.

Description

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An attacker-controlled argument can break out of a parenthesized CMD construct and inject shell syntax depending on the original command, resulting in arbitrary command execution. This issue is fixed in versions 2.1.14 and 3.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-14

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73414

EUVD

EUVD-2026-57531

Affected Vendors & Products

Vendor	Product	Version / Range
shescape	shescape	to 2.1.14 (inc)
shescape	shescape	to 3.0.1 (inc)
ericcornelissen	shescape	to 2.1.14 (exc)
ericcornelissen	shescape	to 3.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-150	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Shescape library, which is used to escape shell commands in JavaScript. On Windows with CMD.exe as the shell, the library fails to properly escape parentheses in input strings. Attackers can exploit this by injecting malicious commands through unescaped parentheses, breaking out of intended command structures and executing arbitrary code.

Detection Guidance

To detect this vulnerability, check if your application uses Shescape versions prior to 2.1.14 or 3.0.1 on Windows with CMD as the shell. Inspect dependencies for shescape package and verify version numbers. No specific commands are provided in the context.

Impact Analysis

If you use Shescape on Windows with CMD.exe or rely on it as the default shell, an attacker could manipulate input strings containing parentheses to execute unintended commands. This could lead to unauthorized actions, data breaches, or system compromise depending on the application's context.

Compliance Impact

This vulnerability could lead to arbitrary command execution, potentially exposing sensitive data or violating data integrity. For GDPR, it may result in unauthorized data processing or breaches. For HIPAA, it could allow unauthorized access to protected health information. Compliance may be impacted if the vulnerability enables data exfiltration or system compromise.

Mitigation Strategies

Immediately upgrade Shescape to version 2.1.14 or 3.0.1 or later. If upgrading is not possible, remove all parentheses from untrusted inputs as a temporary workaround. Migrate from version 2.x to 3.x before September 28, 2026.

Hi! I’m here to help you understand CVE-2026-73414. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70