PT-2026-122456

Published

2026-10-23

·

Updated

2026-10-23

Description by

CVSS 4.0
7.3
High
MetricsAV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
ANT-2026-R7FKP7RG Win32 quote cmd filename misses pipe/redirect metacharacters
ANT-2026-SRZZ62SD Windows batch-file argument injection via maybe quote/make cmdline
ANT-2026-JPEWMPAB Win32 argument quoting leaves embedded CR/LF unescaped
Also includes the fix for OSEC-2026-05
Filename.quote command returns a quoted command line, suitable for use as an argument to Sys.command, Unix.system, and the Unix.open process functions. However on Windows certain characters weren't properly escaped.
Unix.create process can invoke .bat or .cmd programs on Windows, and certain characters were accepted that cannot be quoted safely.

Fix

Filename.quote command has been updated to correctly quote arguments. Unix.create process* has been updated to reject arguments that cannot be safely quoted by raising Failure:
if the program [prog] is a [.bat] or [.cmd] script and either [prog] or [args] contain characters that cannot be securely passed to a script, such as [" | & , ; < = > ^ % "]. If you really need to pass these characters to a script, consider using {!Unix.system} instead.

Am I affected?

If you use Filename.quote command on Windows with user supplied arguments. If you use Unix.create process* or Unix.open process* on Windows with .bat or .cmd programs, and user supplied arguments.

Timeline

  • 2026-08-24: vulnerability was found
  • 2026-08-27: forwarded report to security@ocaml.org
  • 2029-09-05: fix merged to trunk
Exploitability
Fix
Vendors
Affected products
Related identifiers
OSEC-2026-24
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com