CVE-2026-73411 ericcornelissen CVE debrief

Who should care

Defenders responsible for JavaScript applications using the Shescape library should assess exposure and apply fixes to prevent potential path disclosure and command operation manipulation.

Why it matters

CVE-2026-73411 is a vulnerability in the Shescape library for JavaScript that could allow an attacker to disclose the home-directory path and potentially change the location on which a command operates. Defenders should prioritize verifying if their applications use the vulnerable Shescape library versions and apply the fixes.

• Path disclosure of home-directory path.
• Potential manipulation of command operation location.
• Verification of application code for vulnerable Shescape library usage.
• Prioritization of fixes for affected applications.

Technical summary

The Shescape library for JavaScript has a vulnerability in the getEscapeFunction in src/internal/unix/dash.js, which fails to escape ~ after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default. This vulnerability could allow an attacker to disclose the home-directory path and potentially change the location on which a command operates. The issue is fixed in versions 2.1.14 and 3.0.1. Defenders should prioritize verifying if their applications use the vulnerable Shescape library versions and apply the fixes to prevent potential path disclosure and command operation manipulation.

Defensive priority

Defenders should prioritize verifying if their applications use the vulnerable Shescape library versions and apply the fixes to prevent potential path disclosure and command operation manipulation.

Recommended defensive actions

• Verify if applications use Shescape library versions prior to 2.1.14 or 3.0.1.
• Apply fixes by updating to Shescape library versions 2.1.14 or 3.0.1.
• Review application code for usage of escape or escapeAll APIs with shell set to dash or true.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed versions. However, the exact scope of affected applications and the number of victims remain unknown. The vulnerability allows an attacker to supply a value such as :~ to disclose the home-directory path and may change the location on which the command operates. Defenders should verify if their applications use the vulnerable Shescape library versions and apply the fixes. The Shescape library is used in JavaScript applications, and the fixed 2

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.