Critical severity · published Aug 12, 2026
CVE-2026-73414
Shescape: Shell injection via unescaped parentheses on Windows with CMD
9.2
CVSS
0.9%
EPSS
No
On KEV
Description
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An attacker-controlled argument can break out of a parenthesized CMD construct and inject shell syntax depending on the original command, resulting in arbitrary command execution. This issue is fixed in versions 2.1.14 and 3.0.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
shescape · ericcornelissen
< 2.1.14; >= 3.0.0, < 3.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73414
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73414
github.com
https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de
github.com
https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f
github.com
https://github.com/ericcornelissen/shescape/pull/2649
github.com
https://github.com/ericcornelissen/shescape/pull/2651
github.com
https://github.com/ericcornelissen/shescape/releases/tag/v2.1.14
github.com
https://github.com/ericcornelissen/shescape/releases/tag/v3.0.1
More from shescape
9.8
CVE-2022-31179
Insufficient escaping of line feeds for CMD in shescape
9.8
CVE-2022-31180
Insufficient escaping of whitespace in shescape
8.7
CVE-2026-73413
Shescape: Quadratic-time denial of service in flag-protection
6.5
CVE-2026-32094
Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash
6.3
CVE-2026-73412
Shescape: Path disclosure on Unix with Zsh