Shell injection via unescaped parentheses in Shescape on Windows CMD (CVE-2026-73414)

Shescape, a JavaScript shell escape library, fails to escape parentheses (`(` and `)`) when using the `escape` or `escapeAll` APIs on Windows with the shell set to `cmd.exe` or `true` when CMD is the default. An attacker who controls an argument can break out of a parenthesized CMD construct and inject arbitrary shell syntax, resulting in arbitrary command execution. Affected versions: - <2.1.14 - =3.0.0 We recommend updating to: >=2.1.14 <3.0.0, >=3.0.1. CVSS 9.2 · our assessment: act_now Reference: https://github.com/ericcornelissen/shescape/security/advisories/GHSA-w4hw-qcx7-56pr Details: https://vuln.today/cve/CVE-2026-73414