Is CVE-2026-73411 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73411 being exploited in the wild.

How severe is CVE-2026-73411?

Medium severity, with a CVSS score of 4, published 12 August 2026.

Which products and versions are affected?

shescape (npm) SEMVER:introduced=0,fixed=2.1.14.

Is there a fix for CVE-2026-73411?

Yes. shescape (npm): upgrade to 2.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73411 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-73411?

Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73411: Shescape home-directory disclosure in Dash shell assignment

CVE-2026-73411 · Severity: medium · CVSS 4 · Published 2026-08-12

Shescape is a Node.js library that escapes user input to protect against shell injection attacks. On Unix systems using the Dash shell, the library fails to properly escape tilde (~) characters in variable assignments, allowing an attacker to disclose the user's home directory path. This could enable an attacker to redirect command operations to unexpected file locations.

Technologies: shescape (npm). Vendors: npm.

Quick answers

Is CVE-2026-73411 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73411 being exploited in the wild.
How severe is CVE-2026-73411?: Medium severity, with a CVSS score of 4, published 12 August 2026.
Which products and versions are affected?: shescape (npm) SEMVER:introduced=0,fixed=2.1.14.
Is there a fix for CVE-2026-73411?: Yes. shescape (npm): upgrade to 2.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73411 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-73411?: Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

shescape (npm): upgrade to 2.1.14 or later
```
npm install shescape@2.1.14
```

Technical details

The vulnerability is an improper escaping issue (CWE-116, CWE-200) in Shescape's escape() and escapeAll() APIs when processing untrusted input in assignment contexts on Unix systems with Dash shell. The root cause is that tilde expansion is not properly handled during escaping, allowing the sequence `:~` to expand to `:` followed by the user's home directory. This requires the attacker to control input passed to these APIs and the application to use Dash shell (either explicitly configured or as the default). An attacker can extract the home directory path, and depending on command context, redirect operations to unexpected locations. The vulnerability has been patched in Shescape v2.1.14 and v3.0.1.

Affected products

Shescape Shescape <2.1.14 || 3.0.0

Identifiers

CVE-2026-73411
GHSA-q53c-4prm-w95q

Timeline

2026-07-24: disclosed
2026-07-24: patched: Patched in v2.1.14 and v3.0.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.