CVE-2026-32094 Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash
Attackers can exploit unescaped bracket globs in Shescape to expand arguments into multiple filesystem matches, potentially leading to command injection or data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32094?
CVE-2026-32094 is a medium-severity command injection vulnerability in ericcornelissen shescape, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-bracket glob syntax for Bash, BusyBox sh, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like secret[12] to expand into multiple filesystem matches instead of a single literal argument, turning one argument into multiple trusted-pathname matches. This vulnerability is fixed in 2.1.10.
Weakness: CWE-200
Which versions are affected by CVE-2026-32094?
2 open source packages ship an affected version, including shescape. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
shescape npm | All versions | 2.1.10 |
shescape npm | All versions | 2.1.10 |
Products include Shescape Project Shescape.
How do I fix CVE-2026-32094?
Upgrade shescape to 2.1.10 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-32094 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32094 exists.
Other vulnerabilities in ericcornelissen shescape
- CVE-2022-31180 Insufficient escaping of whitespace in shescape
- CVE-2022-31179 Insufficient escaping of line feeds for CMD in shescape
- CVE-2023-40185 Shescape on Windows escaping may be bypassed in threaded context
- CVE-2021-21384 Null characters not escaped in shescape
- CVE-2022-24725 Exposure of home directory through shescape on Unix with Bash
Sources
Also known as GHSA-9jfh-9xrq-4vwm.