CVE-2026-73414: Ericcornelissen Shescape

Critical severity, CVSS 9.2. EPSS: 0.9% chance of exploitation in the next 30 days.

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An attacker-controlled argument can break out of a parenthesized CMD construct and inject shell syntax depending on the original command, resulting in arbitrary command execution. This issue is fixed in versions 2.1.14 and 3.0.1.

Affected products

• Ericcornelissen Shescape: before 2.1.14 (fixed in 2.1.14); from 3.0.0, before 3.0.1 (fixed in 3.0.1)

Published 2026-08-12. Last modified 2026-09-09.