{"id":"CVE-2026-73414","title":"Shescape is a simple shell escape library for JavaScript","summary":"Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escapeAll APIs on Windows with shell set to…","severity":"none","cwe":["CWE-78","CWE-150"],"published":"2026-08-12","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:02:22.660","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73414","references":[{"url":"https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de","label":"security-advisories@github.com"},{"url":"https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f","label":"security-advisories@github.com"},{"url":"https://github.com/ericcornelissen/shescape/pull/2649","label":"security-advisories@github.com"},{"url":"https://github.com/ericcornelissen/shescape/pull/2651","label":"security-advisories@github.com"},{"url":"https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14","label":"security-advisories@github.com"},{"url":"https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1","label":"security-advisories@github.com"},{"url":"https://github.com/ericcornelissen/shescape/security/advisories/GHSA-w4hw-qcx7-56pr","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00524,"epssPercentile":0.43452,"ingestedAt":"2026-08-15T21:29:27.386Z","slug":"CVE-2026-73414","body":"## Overview\n\nShescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An attacker-controlled argument can break out of a parenthesized CMD construct and inject shell syntax depending on the original command, resulting in arbitrary command execution. This issue is fixed in versions 2.1.14 and 3.0.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}