Shescape CVE-2026-73412

Exploitation requires all of the following: (1) the Node.js application must use Shescape with the shell option set explicitly to 'zsh' or to boolean true while the system default shell resolves to Zsh - bash, sh, dash, and other shells are not affected; (2) the application must call escape() or escapeAll() on attacker-controlled input - the quote() and quoteAll() methods are not identified as affected; (3) the application must return or otherwise expose shell command output to the attacker for the disclosure to be useful. The EXTENDED_GLOB variant additionally requires the Zsh EXTENDED_GLOB option to be set in the process environment (e.g., via ~/.zshenv or setopt in a startup file). The MAGIC_EQUAL_SUBST variant requires that option to be enabled. Exploitation is strictly limited to reading file and directory names; no code execution, data modification, or privilege escalation path is present in this vulnerability. Systems defaulting to bash (the overwhelming majority of Linux server deployments) are not affected.

The CVSS 4.0 score of 6.3 with AT:P (attack requirements present) accurately reflects that exploitation is contingent on a non-default shell configuration, which materially limits real-world exposure. The AT:P modifier captures the Zsh prerequisite that most Node.js deployments - which default to bash or sh - do not satisfy, meaning the majority of shescape consumers are unaffected without any remediation action. Impact is bounded to low confidentiality (VC:L): an attacker can enumerate file and directory names but cannot execute arbitrary commands, modify data, or escalate privileges through this flaw alone. EPSS data is not provided in the input, and no independent exploitation campaigns are known; KEV absence further supports a lower urgency classification. The CWE-78 (OS Command Injection) label from NVD overstates the impact - actual consequence is path disclosure, not command injection, and the CVSS impact metrics correctly reflect this narrower scope. For organizations that do explicitly configure Zsh as the shell in shescape options - a deliberate, non-default choice - patching to 2.1.14 or 3.0.1 is straightforward and should be treated as routine maintenance rather than an emergency response.

An attacker submits the string :~ as a user-controlled argument to a Node.js web application that passes it through shescape.escape() with shell configured to 'zsh'. The unpatched escape function does not escape the tilde in the colon-tilde context, and when the sanitized value is passed to child_process.execSync, Zsh expands ~ to the home directory of the process owner (e.g., /home/appuser), which is reflected in command output returned to the attacker. The GitHub advisory contains working proof-of-concept code for this and the EXTENDED_GLOB variant; an attacker with knowledge of the advisory can reproduce the disclosure immediately against vulnerable deployments.