Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to 'sh' or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed to a command, an attacker can inject a tilde payload to disclose the user's home directory location and, [truncated]
CVE-2026-73414 is a critical vulnerability in the Shescape library for JavaScript, allowing for arbitrary command execution on Windows systems when using the escape or escapeAll APIs with shell set to cmd.exe or true. The issue arises from the getEscapeFunction in src/internal/win/cmd.js not escaping `(` and `)` characters. This vulnerability is fixed in Shescape library versions 2.1.14 and 3.0.1. Affecte [truncated]
CVE-2026-73413 is a high-severity vulnerability in the Shescape library for JavaScript, which can lead to denial of service (DoS) attacks when processing large untrusted inputs. The vulnerability affects versions 2.1.11 to 2.1.14 and 3.0.1 of the library. Attackers can exploit this vulnerability by supplying a large input containing many flag fragments, which can cause the library to consume excessive CPU resources.
CVE-2026-73412 is a vulnerability in the Shescape library for JavaScript that allows attackers to leverage home directory expansion and extended glob syntax to obtain lists of files and directories on Unix systems when using Zsh as the shell. The issue is fixed in versions 2.1.14 and 3.0.1. This vulnerability has the potential to lead to file and directory enumeration, and possibly information leaks about [truncated]
CVE-2026-73411 is a vulnerability in the Shescape library for JavaScript, which could allow an attacker to disclose the home-directory path and potentially change the location on which a command operates. The issue is fixed in versions 2.1.14 and 3.0.1. Defenders should assess exposure and apply fixes to prevent potential path disclosure and command operation manipulation. The vulnerability exists in the [truncated]
