CVE-2026-73412 ericcornelissen CVE debrief

Who should care

Defenders responsible for systems using Shescape on Unix systems with Zsh as the default shell should assess exposure and prioritize patching or mitigating this vulnerability. This includes IT security teams, system administrators, and developers who use Shescape in their applications. They should verify if Shescape versions 2.1.14 or 3.0.1 have been applied and monitor for potential file and directory enumeration attempts.

Why it matters

CVE-2026-73412 is a vulnerability in the Shescape library for JavaScript that allows attackers to leverage home directory expansion and extended glob syntax to obtain lists of files and directories on Unix systems when using Zsh as the shell. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Shescape is used on Unix systems with Zsh as the default shell.

• Potential file and directory enumeration on Unix systems with Zsh as the shell
• Possible information leak about system files and directories
• Need to verify Shescape version and Zsh usage in the environment
• Potential impact on systems with Shescape used in scripts or applications

Technical summary

The Shescape library for JavaScript is vulnerable to an issue that allows attackers to leverage home directory expansion and extended glob syntax to obtain lists of files and directories on Unix systems when using Zsh as the shell. This is due to the Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST exacerbating the problem. The issue is fixed in versions 2.1.14 and 3.0.1. Affected systems include those using Shescape on Unix systems with Zsh as the default shell. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Shescape is used on Unix systems with Zsh as the default shell.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Shescape is used on Unix systems with Zsh as the default shell.

Recommended defensive actions

• Assess exposure to Shescape on Unix systems with Zsh as the default shell
• Verify if Shescape versions 2.1.14 or 3.0.1 have been applied
• Monitor for potential file and directory enumeration attempts
• Review system logs for suspicious activity related to Shescape
• Perform a thorough review of system scripts and applications that use Shescape
• Inventory assets that use Shescape and prioritize patching based on criticality
• Implement compensating controls for exposed systems while remediation is scheduled

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, its impact, and the fixed versions. However, the exact scope of affected systems and potential exploitation require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.