Shell Escape Vulnerability in Shescape Library for JavaScript
CVE-2026-73411
6.3MEDIUM
What is CVE-2026-73411?
The Shescape library for JavaScript is affected by a vulnerability that occurs in the getEscapeFunction method, where the library fails to correctly escape the character '~' when using the escape or escapeAll APIs on Unix systems with dash as the default shell. This oversight allows an attacker with control over the input to craft a specific value (such as ':~') that can potentially disclose the user's home directory path or alter the execution context of a command. This issue has been resolved in versions 2.1.14 and 3.0.1 of the library.
Affected Version(s)
shescape < 2.1.14 < 2.1.14
shescape >= 3.0.0, < 3.0.1 < 3.0.0, 3.0.1