CVE-2026-73411

Name of the Vulnerable Software and Affected Versions Shescape versions prior to 2.1.14 Shescape versions prior to 3.0.1

Description The getEscapeFunction() function in src/internal/unix/dash.js fails to properly escape the ~ character when it follows a : or = character. This occurs when applications utilize the escape or escapeAll APIs on Unix systems where the shell is set to dash, or set to true while Dash is the default, and the result is interpolated into a command assignment. An attacker providing a value such as :~ can disclose the home-directory path and potentially alter the operating location of the command.

Recommendations Update to version 2.1.14. Update to version 3.0.1.