Skip to main content

Shescape EUVDEUVD-2026-57531

| CVE-2026-73414 CRITICAL
OS Command Injection (CWE-78)
2026-08-12 GitHub_M GHSA-w4hw-qcx7-56pr
Command Injection Microsoft Shescape
9.2
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.1 HIGH

AC:H because exploitation requires the app to use the CMD backend and embed input in a parenthesized construct; PR:N/UI:N as the library imposes no auth; full C/I/A from arbitrary command execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 12, 2026 - 21:17 EUVD
Source Code Evidence Fetched
Aug 12, 2026 - 20:21 vuln.today
Analysis Generated
Aug 12, 2026 - 20:21 vuln.today
CVE Published
Aug 12, 2026 - 19:42 cve.org
CRITICAL 9.2

DescriptionCVE.org

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape ( and ) when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An attacker-controlled argument can break out of a parenthesized CMD construct and inject shell syntax depending on the original command, resulting in arbitrary command execution. This issue is fixed in versions 2.1.14 and 3.0.1.

AnalysisAI

Command injection in Shescape (npm shell-escaping library) versions below 2.1.14 and the 3.0.x line below 3.0.1 allows an attacker-controlled argument to break out of a parenthesized cmd.exe construct and inject arbitrary shell syntax on Windows. The flaw affects applications that call the escape or escapeAll APIs with shell set to cmd.exe (or shell:true when CMD is the default), because getEscapeFunction in src/internal/win/cmd.js failed to escape the ( and ) characters. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Submit crafted argument to Windows app
Delivery
App escapes input via Shescape escape/escapeAll
Exploit
Unescaped ')' breaks out of CMD parenthesized block
Execution
Injected CMD syntax parsed as new commands
Impact
Arbitrary command execution on host
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all of the following concrete prerequisites: (1) the target application runs on Windows; (2) it uses Shescape's escape or escapeAll API; (3) it invokes child_process with shell set to 'cmd.exe', or shell:true while CMD is the system default shell; and (4) the escaped attacker input is placed inside a parenthesized CMD construct (e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 9.2 (Critical) reflects a network-reachable, no-privilege, no-interaction path to full C/I/A compromise, but the Attack Requirements flag (AT:P) is the key nuance: exploitation is not universal - it depends on the consuming application actually running on Windows with CMD and embedding the escaped argument inside a parenthesized CMD construct. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A Windows-hosted Node.js application takes a user-supplied value (e.g. a form field or API parameter), escapes it with shescape.escape, and interpolates it into a cmd.exe command that wraps the value in parentheses such as 'if defined FALSY (echo <input>)'. …
Remediation Vendor-released patch: upgrade to Shescape 2.1.14 (v2 line) or 3.0.1 (v3 line). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit your npm dependencies to identify all applications using Shescape, prioritizing those running on Windows with cmd.exe and processing untrusted input. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Shescape

View all
CVE-2022-31180 CRITICAL POC
9.8 Aug 01

Shescape is a simple shell escape package for JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remo
CVE-2022-31179 CRITICAL POC
9.8 Aug 01

Shescape is a simple shell escape package for JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remo
CVE-2023-40185 HIGH POC
8.6 Aug 23

shescape is simple shell escape library for JavaScript. Rated high severity (CVSS 8.6), this vulnerability is remotely e
CVE-2021-21384 HIGH POC
7.8 Mar 19

shescape is a simple shell escape package for JavaScript. Rated high severity (CVSS 7.8), this vulnerability is low atta
CVE-2022-25918 HIGH POC
7.5 Oct 27

The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the
CVE-2022-36064 HIGH POC
7.5 Sep 06

Shescape is a shell escape package for JavaScript. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi
CVE-2022-24725 MEDIUM POC
5.5 Mar 03

Shescape is a shell escape package for JavaScript. Rated medium severity (CVSS 5.5), this vulnerability is low attack co
CVE-2026-73413 HIGH
8.7 Aug 12

Quadratic-time CPU exhaustion in Shescape's flag-protection loop allows any attacker who can supply untrusted input to t
CVE-2023-35931 MEDIUM POC
4.3 Jun 23

Shescape is a simple shell escape library for JavaScript. Rated medium severity (CVSS 4.3), this vulnerability is remote
CVE-2026-32094 MEDIUM
6.5 Mar 11

Shescape versions prior to 2.1.10 fail to properly escape square-bracket glob patterns in Bash, BusyBox sh, and Dash, al
CVE-2026-73412 MEDIUM
6.3 Aug 12

Incomplete Zsh special-character escaping in Shescape allows unauthenticated attackers who control input strings to bypa
CVE-2026-73411 MEDIUM
6.3 Aug 12

Incomplete tilde-escaping in Shescape's Dash shell mode allows attacker-controlled input to bypass sanitization and trig

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

EUVD-2026-57531 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy