{"action":"Upgrade shescape to 2.1.14 or later.","affected":[{"fixed":"2.1.14","introduced":"0"},{"fixed":"3.0.1","introduced":"3.0.0"}],"component":"shescape","cve_ids":["CVE-2026-73414"],"ecosystem":"npm","epss":0.00889,"exploited":false,"fixed_versions":["2.1.14","3.0.1"],"ghsa_id":"GHSA-w4hw-qcx7-56pr","id":"tcs_01M5KGDWGYTDM2ZT33GFGNV452","modified_at":"2026-08-12T19:59:13.898763Z","published_at":"2026-07-24T22:34:23Z","references":["https://osv.dev/vulnerability/GHSA-w4hw-qcx7-56pr","https://github.com/ericcornelissen/shescape/security/advisories/GHSA-w4hw-qcx7-56pr","https://github.com/ericcornelissen/shescape/pull/2649","https://github.com/ericcornelissen/shescape/pull/2651","https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de","https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f","https://github.com/ericcornelissen/shescape","https://github.com/ericcornelissen/shescape/blob/dea8893a5877893d8d4923dbf253080e08899e6d/docs/migration.md","https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14","https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1"],"severity":{"label":"critical","score":9.2},"sources":[{"source":"osv","source_id":"GHSA-w4hw-qcx7-56pr","url":"https://osv.dev/vulnerability/GHSA-w4hw-qcx7-56pr"},{"source":"nvd","source_id":"CVE-2026-73414","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73414"}],"summary":"Shescape: Shell injection via unescaped parentheses on Windows with CMD"}