PT-2026-122456

Publicado

2026-10-23

·

Atualizado

2026-10-23

Descrição por

CVSS 4.0
7.3
Alta
MétricasAV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
ANT-2026-R7FKP7RG Win32 quote cmd filename misses pipe/redirect metacharacters
ANT-2026-SRZZ62SD Windows batch-file argument injection via maybe quote/make cmdline
ANT-2026-JPEWMPAB Win32 argument quoting leaves embedded CR/LF unescaped
Also includes the fix for OSEC-2026-05
Filename.quote command returns a quoted command line, suitable for use as an argument to Sys.command, Unix.system, and the Unix.open process functions. However on Windows certain characters weren't properly escaped.
Unix.create process can invoke .bat or .cmd programs on Windows, and certain characters were accepted that cannot be quoted safely.

Fix

Filename.quote command has been updated to correctly quote arguments. Unix.create process* has been updated to reject arguments that cannot be safely quoted by raising Failure:
if the program [prog] is a [.bat] or [.cmd] script and either [prog] or [args] contain characters that cannot be securely passed to a script, such as [" | & , ; < = > ^ % "]. If you really need to pass these characters to a script, consider using {!Unix.system} instead.

Am I affected?

If you use Filename.quote command on Windows with user supplied arguments. If you use Unix.create process* or Unix.open process* on Windows with .bat or .cmd programs, and user supplied arguments.

Timeline

  • 2026-08-24: vulnerability was found
  • 2026-08-27: forwarded report to security@ocaml.org
  • 2029-09-05: fix merged to trunk
Explorabilidade
Correção
Fornecedores
Produtos afetados
Identificadores relacionados
OSEC-2026-24
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com