Is CVE-2026-73412 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73412 being exploited in the wild.

How severe is CVE-2026-73412?

Medium severity, with a CVSS score of 4, published 12 August 2026.

Which products and versions are affected?

shescape (npm) SEMVER:introduced=0,fixed=2.1.14.

Is there a fix for CVE-2026-73412?

Yes. shescape (npm): upgrade to 2.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73412 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-73412?

Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73412: Shescape path disclosure on Unix with Zsh

CVE-2026-73412 · Severity: medium · CVSS 4 · Published 2026-08-12

Shescape is a Node.js library that escapes user input to safely pass it to shell commands. On Unix systems using Zsh shell, the library fails to properly escape certain special characters, allowing attackers to leak the user's home directory path and enumerate files and directories on the system. This information disclosure could be leveraged to gain additional reconnaissance for further attacks.

Technologies: shescape (npm). Vendors: npm.

Quick answers

Is CVE-2026-73412 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73412 being exploited in the wild.
How severe is CVE-2026-73412?: Medium severity, with a CVSS score of 4, published 12 August 2026.
Which products and versions are affected?: shescape (npm) SEMVER:introduced=0,fixed=2.1.14.
Is there a fix for CVE-2026-73412?: Yes. shescape (npm): upgrade to 2.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73412 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-73412?: Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

shescape (npm): upgrade to 2.1.14 or later
```
npm install shescape@2.1.14
```

Technical details

The vulnerability is an improper neutralization of wildcard and glob syntax in shell escaping (CWE-155, CWE-78). When Shescape's escape() and escapeAll() functions process user input for Zsh, they fail to neutralize tilde (~) expansion and extended glob patterns (EXTENDED_GLOB option with ^, # syntax). An attacker can craft payloads like ":~" or "pa#ckage.json" that bypass the escaping mechanism, causing Zsh to interpret them as glob patterns or home directory expansion rather than literal strings. This occurs when Shescape is explicitly configured to use Zsh or when Zsh is the system's default shell. The attack requires network reachability to the application using Shescape, but no authentication or special user interaction. Patches are available in v2.1.14 and v3.0.1.

Affected products

Shescape Shescape <2.1.14 and 3.0.0

Identifiers

CVE-2026-73412
GHSA-6v4m-fw66-8r4x

Timeline

2026-07-24: disclosed
2026-07-24: patched: v2.1.14 and v3.0.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.