Log in Start free

Vulnerability · Published Aug 12, 2026 · Assigned by GitHub_M

CVE-2026-73412Shescape: Path disclosure on Unix with Zsh

Medium 6.3

In plain English

A medium-severity OS command injection in shescape from ericcornelissen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.6%top 50.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used to leak more information. This issue is fixed in versions 2.1.14 and 3.0.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmshescape2.1.14GHSA-6v4m-fw66-8r4x
npmshescape3.0.1GHSA-6v4m-fw66-8r4x

Affected products (as reported)

VendorProductVersions
ericcornelissen shescape < 2.1.14>= 3.0.0, < 3.0.1

Weakness: CWE-78, CWE-155 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References