CVE-2026-73412 Shescape: Path disclosure on Unix with Zsh
An attacker can exploit Zsh globbing features in the Shescape library to disclose file and directory listings on Unix systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73412?
CVE-2026-73412 is a medium-severity vulnerability in ericcornelissen shescape, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used to leak more information. This issue is fixed in versions 2.1.14 and 3.0.1.
Which versions are affected by CVE-2026-73412?
4 open source packages ship an affected version, including shescape.
| Package | Affected | Fixed in |
|---|---|---|
shescape npm | All versions | 2.1.14 |
shescape npm | All versions | 2.1.14 |
shescape npm | From 3.0.0 | 3.0.1 |
shescape npm | From 3.0.0 | 3.0.1 |
How do I fix CVE-2026-73412?
Upgrade shescape to a fixed version for your release line: 2.1.14 or 3.0.1.
Is CVE-2026-73412 being exploited?
There is no known exploitation of CVE-2026-73412 in the wild and no public exploit code.
Sources
Also known as GHSA-6v4m-fw66-8r4x.