CVE-2026-41083

Name of the Vulnerable Software and Affected Versions OCaml versions prior to 4.14.4

Description On Windows, the Filename.quote command function fails to properly escape certain characters, including pipe and redirect metacharacters, as well as embedded carriage return (CR) and line feed (LF) characters. This deficiency allows an attacker to perform shell command injection if they can control the arguments, such as the stdin, stdout, or stderr of a program to be executed. Additionally, Unix.create process can invoke .bat or .cmd programs on Windows using arguments that cannot be quoted safely, leading to batch-file argument injection via maybe quote or make cmdline.

Recommendations Update OCaml to version 4.14.4 or later. As a temporary mitigation, avoid using Filename.quote command on Windows with user-supplied arguments. Restrict the use of Unix.create process* or Unix.open process* on Windows when invoking .bat or .cmd programs with user-supplied arguments.