CVE-2026-73414
1 advisory.
npm/shescape CVE-2026-73414: critical
Shescape: Shell injection via unescaped parentheses on Windows with CMD
Action: Upgrade shescape to 2.1.14 or later.
npm i shescape@2.1.14npm i shescape@3.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.14 | - |
| 3.0.0 | 3.0.1 | - |
Fixed versions
| 2.1.14 | 3.0.1 |
Sources
- osv: GHSA-w4hw-qcx7-56pr
- https://github.com/ericcornelissen/shescape/security/advisories/GHSA-w4hw-qcx7-56pr
- https://github.com/ericcornelissen/shescape/pull/2649
- https://github.com/ericcornelissen/shescape/pull/2651
- https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de
- https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f
- https://github.com/ericcornelissen/shescape
- https://github.com/ericcornelissen/shescape/blob/dea8893a5877893d8d4923dbf253080e08899e6d/docs/migration.md
- https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14
- https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1
CVE-2026-73414 · published · modified · JSON