{"action":"Upgrade shescape to 2.1.14 or later.","affected":[{"fixed":"2.1.14","introduced":"0"},{"fixed":"3.0.1","introduced":"3.0.0"}],"component":"shescape","cve_ids":["CVE-2026-73412"],"ecosystem":"npm","epss":0.00612,"exploited":false,"fixed_versions":["2.1.14","3.0.1"],"ghsa_id":"GHSA-6v4m-fw66-8r4x","id":"tcs_01M5KF7YXSGVDZYGGHZ85RQ4EG","modified_at":"2026-08-27T05:15:08.086538212Z","published_at":"2026-07-24T22:33:38Z","references":["https://osv.dev/vulnerability/GHSA-6v4m-fw66-8r4x","https://github.com/ericcornelissen/shescape/security/advisories/GHSA-6v4m-fw66-8r4x","https://github.com/ericcornelissen/shescape/pull/2649","https://github.com/ericcornelissen/shescape/pull/2651","https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de","https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f","https://github.com/ericcornelissen/shescape","https://github.com/ericcornelissen/shescape/blob/dea8893a5877893d8d4923dbf253080e08899e6d/docs/migration.md","https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14","https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-6v4m-fw66-8r4x","url":"https://osv.dev/vulnerability/GHSA-6v4m-fw66-8r4x"},{"source":"nvd","source_id":"CVE-2026-73412","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73412"}],"summary":"Shescape: Path disclosure on Unix with Zsh"}