ericcornelissen Shescape up to 2.1.13/3.0.0 escape output

Summaryinfo

A vulnerability marked as problematic has been reported in ericcornelissen Shescape up to 2.1.13/3.0.0. This issue affects the function escape. This manipulation causes escape output. The identification of this vulnerability is CVE-2026-73412. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in ericcornelissen Shescape up to 2.1.13/3.0.0. It has been declared as problematic. Affected by this vulnerability is the function escape. The manipulation with an unknown input leads to a escape output vulnerability. The CWE definition for the vulnerability is CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. As an impact it is known to affect confidentiality. The summary by CVE is:

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used to leak more information. This issue is fixed in versions 2.1.14 and 3.0.1.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-73412 since 08/12/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.1.14 or 3.0.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• ericcornelissen

Name

• Shescape

Version

• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.1.6
• 2.1.7
• 2.1.8
• 2.1.9
• 2.1.10
• 2.1.11
• 2.1.12
• 2.1.13
• 3.0

Website

• Product: https://github.com/ericcornelissen/shescape/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion