CVE-2026-73412 in Shescape
Summary
by MITRE • 08/12/2026
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used to leak more information. This issue is fixed in versions 2.1.14 and 3.0.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The shescape library presents a significant security vulnerability affecting Unix systems where Zsh is configured as the default shell or explicitly specified by users. This vulnerability stems from improper handling of shell escaping mechanisms when dealing with Zsh-specific features, particularly the EXTENDED_GLOB and MAGIC_EQUAL_SUBST options that are enabled by default in Zsh environments. The flaw manifests when developers utilize the escape and escapeAll functions provided by shescape, creating a pathway for malicious input to bypass intended security boundaries.
The technical exploitation occurs through the combination of home directory expansion features and extended globbing syntax inherent to Zsh. When an attacker crafts malicious input containing specific shell metacharacters, the inadequate escaping logic allows these patterns to be interpreted by the shell rather than treated as literal text. The EXTENDED_GLOB option enables powerful pattern matching capabilities including brace expansion, while MAGIC_EQUAL_SUBST permits automatic substitution of equal signs, both of which can be leveraged to traverse filesystem structures and enumerate directory contents. This represents a classic command injection vulnerability that operates at the shell level rather than application level.
The operational impact extends beyond simple information disclosure, as the ability to list files and directories provides attackers with valuable reconnaissance data that could lead to more sophisticated attacks. Depending on the specific commands being executed and the context in which shescape is used, this vulnerability could enable attackers to discover sensitive files, understand system structure, or identify potential targets for privilege escalation. The vulnerability affects both version 2.x and 3.x branches of the library, indicating a fundamental flaw in the escaping implementation that persisted across major releases.
Security practitioners should consider this vulnerability in relation to CWE-78 which addresses improper neutralization of special elements used in OS commands, and CWE-20 which covers input validation issues. The attack pattern aligns with ATT&CK technique T1059.001 for command and script injection, specifically targeting shell command execution through inadequate input sanitization. Organizations using shescape in environments where Zsh is prevalent or explicitly configured should immediately upgrade to versions 2.1.14 or 3.0.1 respectively, as these releases contain the necessary fixes to properly handle shell escaping when extended globbing features are active. The mitigation strategy involves not only updating the library but also reviewing all code paths that utilize shescape functions to ensure proper input validation and sanitization practices are implemented at higher levels of the application stack.