Shescape CVE-2026-73414

Exploitation requires all of the following concrete prerequisites: (1) the target application runs on Windows; (2) it uses Shescape's escape or escapeAll API; (3) it invokes child_process with shell set to 'cmd.exe', or shell:true while CMD is the system default shell; and (4) the escaped attacker input is placed inside a parenthesized CMD construct (e.g. an if/else block using '(...)') in the original command - this is the exact condition captured by the CVSS AT:P (Attack Requirements: Present) flag. Limiting factors: applications on Unix shells, on PowerShell, or that pass arguments as an argv array (not through CMD) are not affected; and if the surrounding command never wraps the argument in parentheses, the breakout construct has nothing to escape from. No user authentication or interaction is required by the library itself (PR:N/UI:N), but whether the tainted input is remotely reachable is a property of the host application.

The CVSS 4.0 base score of 9.2 (Critical) reflects a network-reachable, no-privilege, no-interaction path to full C/I/A compromise, but the Attack Requirements flag (AT:P) is the key nuance: exploitation is not universal - it depends on the consuming application actually running on Windows with CMD and embedding the escaped argument inside a parenthesized CMD construct. That makes real-world exploitability conditional on how each downstream app uses the library, so this is better characterized as a serious-but-context-dependent library flaw than a blanket internet-wide RCE. The vendor advisory ships a concrete working payload ('x) else if a==a (echo y'), which meaningfully lowers the barrier to exploitation for affected deployments, yet there is no EPSS figure provided and no CISA KEV entry, so I cannot assert widespread or active exploitation. On balance, any team shipping a Windows product that passes untrusted input through Shescape's escape/escapeAll with CMD should treat patching as urgent, while teams on non-Windows shells or not using the CMD backend face materially lower real risk. Note the data conflict to verify: the raw CVSS asserts AV:N/PR:N/UI:N (unauthenticated remote), but whether input is remotely reachable is entirely a property of the host application, not the library itself.

A Windows-hosted Node.js application takes a user-supplied value (e.g. a form field or API parameter), escapes it with shescape.escape, and interpolates it into a cmd.exe command that wraps the value in parentheses such as 'if defined FALSY (echo <input>)'. An attacker submits 'x) else if a==a (echo y', whose unescaped ) closes the CMD block early and injects attacker-chosen syntax, causing the shell to execute unintended commands. A working payload demonstrating this is published in the GHSA advisory, and the low attack complexity means it succeeds reliably once the parenthesized-construct precondition is met.