Security Advisory

CVE-2026-73414

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-12 19:42:55

Last updated 2026-08-14 22:11:29

Assigner GitHub_M

CVSS score not scored

State PUBLISHED

Description

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An attacker-controlled argument can break out of a parenthesized CMD construct and inject shell syntax depending on the original command, resulting in arbitrary command execution. This issue is fixed in versions 2.1.14 and 3.0.1.

← Browse all CVEs View on cve.org ↗