CVE-2026-73414 Shescape: Shell injection via unescaped parentheses on Windows with CMD
An attacker can execute arbitrary commands on Windows by injecting unescaped parentheses into arguments processed by the Shescape library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73414?
CVE-2026-73414 is a critical command injection vulnerability in ericcornelissen shescape, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An attacker-controlled argument can break out of a parenthesized CMD construct and inject shell syntax depending on the original command, resulting in arbitrary command execution. This issue is fixed in versions 2.1.14 and 3.0.1.
Which versions are affected by CVE-2026-73414?
4 open source packages ship an affected version, including shescape.
| Package | Affected | Fixed in |
|---|---|---|
shescape npm | All versions | 2.1.14 |
shescape npm | All versions | 2.1.14 |
shescape npm | From 3.0.0 | 3.0.1 |
shescape npm | From 3.0.0 | 3.0.1 |
How do I fix CVE-2026-73414?
Upgrade shescape to a fixed version for your release line: 2.1.14 or 3.0.1.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-73414 being exploited?
There is no known exploitation of CVE-2026-73414 in the wild and no public exploit code.
Sources
Also known as GHSA-w4hw-qcx7-56pr.