CVE-2026-73412: Shescape: Path disclosure on Unix with Zsh
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used to leak more information. This issue is fixed in versions 2.1.14 and 3.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Shescapeto a version that resolves this vulnerability.Fixed in 2.1.14 - Upgrade
Upgrade
Shescapeto a version that resolves this vulnerability.Fixed in 3.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73412?
CVE-2026-73412 has a risk rating of 26, indicating a critical vulnerability.
How do I fix CVE-2026-73412?
To mitigate CVE-2026-73412, upgrade Shescape to version 2.1.14 or 3.0.1 or later.
What systems are affected by CVE-2026-73412?
CVE-2026-73412 affects Unix systems that specifically configure the shell to Zsh.
What type of vulnerability is CVE-2026-73412?
CVE-2026-73412 is classified as an OS Command Injection vulnerability.
What is the impact of CVE-2026-73412?
CVE-2026-73412 can lead to path disclosure which may expose sensitive information.