PT-2026-71292 · Npm · Shescape

CVE-2026-73414

·

Published

2026-07-24

·

Updated

2026-08-14

CVSS v4.0

9.2

Critical

VectorAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Shescape versions prior to 2.1.14 Shescape versions prior to 3.0.1
Description The getEscapeFunction() function in src/internal/win/cmd.js fails to escape ( and ) characters when using the escape or escapeAll APIs on Windows systems where the shell is set to cmd.exe or defaults to CMD. This allows an attacker to provide a controlled argument that breaks out of a parenthesized CMD construct and injects shell syntax, potentially leading to arbitrary command execution.
Recommendations Update to version 2.1.14 or later. Update to version 3.0.1 or later.

Exploit

Fix

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78CWE-150

Related Identifiers

CVE-2026-73414
GHSA-W4HW-QCX7-56PR

Affected Products

Shescape