PT-2026-71292

CVE-2026-73414

Published

2026-07-24

Updated

2026-08-14

Description by

CVSS 4.0

9.2

Critical

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Shescape versions prior to 2.1.14 Shescape versions prior to 3.0.1

Description The getEscapeFunction() function in src/internal/win/cmd.js fails to escape ( and ) characters when using the escape or escapeAll APIs on Windows systems where the shell is set to cmd.exe or defaults to CMD. This allows an attacker to provide a controlled argument that breaks out of a parenthesized CMD construct and injects shell syntax, potentially leading to arbitrary command execution.

Recommendations Update to version 2.1.14 or later. Update to version 3.0.1 or later.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers

CVE-2026-73414