Skip to main content

Shescape EUVDEUVD-2026-57518

| CVE-2026-73411 MEDIUM
Improper Encoding or Escaping of Output (CWE-116)
2026-08-12 GitHub_M GHSA-q53c-4prm-w95q
Information Disclosure Shescape
6.3
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 12, 2026 - 22:03 EUVD
Source Code Evidence Fetched
Aug 12, 2026 - 20:51 vuln.today
Analysis Generated
Aug 12, 2026 - 20:51 vuln.today

DescriptionCVE.org

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, and interpolate the result into an assignment prefixed to a command. An attacker who controls the input can supply a value such as :~ to disclose the home-directory path and may change the location on which the command operates. This issue is fixed in versions 2.1.14 and 3.0.1.

AnalysisAI

Incomplete tilde-escaping in Shescape's Dash shell mode allows attacker-controlled input to bypass sanitization and trigger home-directory expansion. Shescape versions prior to 2.1.14 (v2 branch) and 3.0.1 (v3 branch) on Unix systems fail to escape ~ when it follows : or =, characters that Dash recognizes as tilde-expansion triggers in assignment contexts. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Shescape

View all
CVE-2022-31180 CRITICAL POC
9.8 Aug 01

Shescape is a simple shell escape package for JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remo
CVE-2022-31179 CRITICAL POC
9.8 Aug 01

Shescape is a simple shell escape package for JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remo
CVE-2023-40185 HIGH POC
8.6 Aug 23

shescape is simple shell escape library for JavaScript. Rated high severity (CVSS 8.6), this vulnerability is remotely e
CVE-2021-21384 HIGH POC
7.8 Mar 19

shescape is a simple shell escape package for JavaScript. Rated high severity (CVSS 7.8), this vulnerability is low atta
CVE-2022-25918 HIGH POC
7.5 Oct 27

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the
CVE-2022-36064 HIGH POC
7.5 Sep 06

Shescape is a shell escape package for JavaScript. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi
CVE-2022-24725 MEDIUM POC
5.5 Mar 03

Shescape is a shell escape package for JavaScript. Rated medium severity (CVSS 5.5), this vulnerability is low attack co
CVE-2026-73414 CRITICAL
9.2 Aug 12

Command injection in Shescape (npm shell-escaping library) versions below 2.1.14 and the 3.0.x line below 3.0.1 allows a
CVE-2026-73413 HIGH
8.7 Aug 12

Quadratic-time CPU exhaustion in Shescape's flag-protection loop allows any attacker who can supply untrusted input to t
CVE-2023-35931 MEDIUM POC
4.3 Jun 23

Shescape is a simple shell escape library for JavaScript. Rated medium severity (CVSS 4.3), this vulnerability is remote
CVE-2026-32094 MEDIUM
6.5 Mar 11

Shescape versions prior to 2.1.10 fail to properly escape square-bracket glob patterns in Bash, BusyBox sh, and Dash, al
CVE-2026-73412 MEDIUM
6.3 Aug 12

Incomplete Zsh special-character escaping in Shescape allows unauthenticated attackers who control input strings to bypa

Same weakness CWE-116 – Improper Encoding or Escaping of Output

View all
CVE-2013-4547 HIGH POC
7.5
CVE-2026-20245 HIGH POC
7.8
CVE-2022-36446 CRITICAL POC
9.8
CVE-2017-8303 CRITICAL POC
9.8
CVE-2022-30781 HIGH POC
7.5
CVE-2023-46301 CRITICAL POC
9.8
CVE-2023-46300 CRITICAL POC
9.8
CVE-2022-41443 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-57518 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy