LOWVulnerability
CVE-2026-73414
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An attacker-controlled argument can break out of a parenthesized CMD construct and inject shell syntax depending on the original command, resulting in arbitrary command execution. This issue is fixed in versions 2.1.14 and 3.0.1.
Properties
- epss_score
- 0.00524
- cve_id
- CVE-2026-73414
- published_at
- 2026-08-12T20:17:56.510
- last_modified
- 2026-09-09T21:02:22.660
- epss_percentile
- 0.42762
Related Entities (4)
ENRICHED_BY (1)
→[Source]FIRST EPSS
HAS_WEAKNESS (2)
→[Weakness]Improper Neutralization of Escape, Meta, or Control Sequences
→[Weakness]Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph