CVE-2026-73411 in Shescape
Summary
by MITRE • 08/12/2026
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, and interpolate the result into an assignment prefixed to a command. An attacker who controls the input can supply a value such as :~ to disclose the home-directory path and may change the location on which the command operates. This issue is fixed in versions 2.1.14 and 3.0.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
The shescape library presents a significant security vulnerability affecting Unix systems when using the dash shell, specifically impacting versions prior to 2.1.14 and 3.0.1. This flaw exists within the getEscapeFunction implementation located in src/internal/unix/dash.js where the library fails to properly escape tilde characters (~) that appear after colons (:) or equals signs (=) during shell escaping operations. The vulnerability manifests when applications utilize either the escape or escapeAll APIs with Unix systems configured to use dash shell, or when shell is set to true and Dash serves as the default shell. The technical implementation issue stems from incomplete sanitization of user-controlled input within shell command construction contexts, creating a path traversal and command injection vector through improper escaping of special characters.
The operational impact of this vulnerability extends beyond simple information disclosure, as attackers can exploit the incomplete escaping mechanism to manipulate command execution paths by crafting malicious input such as :~ which reveals the home directory path. This allows adversaries to potentially redirect command operations to unintended locations within the filesystem, effectively enabling privilege escalation or unauthorized access to sensitive directories and files. The flaw particularly affects scenarios where command arguments are interpolated into assignments that prefix commands, creating a direct pathway for attackers to manipulate shell execution flow through carefully crafted input sequences.
This vulnerability aligns with CWE-78 and CWE-20 categories, representing a classic command injection weakness through improper input sanitization and shell escaping mechanisms. The issue maps to ATT&CK technique T1059.004 which covers Unix Shell commands and scripts, where adversaries can leverage incomplete escaping to manipulate shell execution environments. The root cause demonstrates poor input validation and sanitization practices in shell escape libraries, particularly when handling special characters like tilde that have semantic meaning in Unix shell environments. Organizations using shescape in production environments face potential risks including unauthorized file access, privilege escalation, and command injection attacks when applications process user-supplied data through the vulnerable escape functions.
The fix implemented in versions 2.1.14 and 3.0.1 addresses the core escaping logic by ensuring proper sanitization of tilde characters regardless of their position relative to colons or equals signs in shell command contexts. System administrators should immediately upgrade all affected installations to the patched versions, while security teams should review existing applications that utilize shescape to verify proper input validation and sanitization practices are implemented. Organizations utilizing dash shell environments specifically must conduct comprehensive vulnerability assessments to identify any applications that may be susceptible to this class of injection attacks through improper shell escaping mechanisms.