{"action":"Upgrade shescape to 2.1.14 or later.","affected":[{"fixed":"2.1.14","introduced":"0"},{"fixed":"3.0.1","introduced":"3.0.0"}],"component":"shescape","cve_ids":["CVE-2026-73411"],"ecosystem":"npm","epss":0.0059,"exploited":false,"fixed_versions":["2.1.14","3.0.1"],"ghsa_id":"GHSA-q53c-4prm-w95q","id":"tcs_01M5KG56WE25QGPQ9AZ3MCYXAD","modified_at":"2026-08-12T19:59:13.666028Z","published_at":"2026-07-24T22:34:39Z","references":["https://osv.dev/vulnerability/GHSA-q53c-4prm-w95q","https://github.com/ericcornelissen/shescape/security/advisories/GHSA-q53c-4prm-w95q","https://github.com/ericcornelissen/shescape/pull/2649","https://github.com/ericcornelissen/shescape/pull/2651","https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de","https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f","https://github.com/ericcornelissen/shescape","https://github.com/ericcornelissen/shescape/blob/dea8893a5877893d8d4923dbf253080e08899e6d/docs/migration.md","https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14","https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-q53c-4prm-w95q","url":"https://osv.dev/vulnerability/GHSA-q53c-4prm-w95q"},{"source":"nvd","source_id":"CVE-2026-73411","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73411"}],"summary":"Shescape: Home-directory disclosure in assignment context on Unix with Dash"}