Executive brief
Shescape is a Node.js library used to safely escape command-line arguments before executing shell commands. On Windows systems using the CMD shell, the library fails to properly escape parentheses in user-supplied input, allowing attackers to inject arbitrary shell commands. An application using Shescape could be tricked into executing unintended commands, potentially leading to unauthorized access, data theft, or system compromise.
Technical details
This is an OS command injection vulnerability (CWE-78) caused by improper neutralization of escape sequences (CWE-150) in Shescape's escape and escapeAll APIs when targeting the Windows CMD shell. The vulnerability exists in versions before 2.1.14 and in version 3.0.0 (fixed in 3.0.1). The root cause is that parentheses are not properly escaped, allowing attackers to break out of the intended command context. The attack requires the application to use Shescape with cmd.exe explicitly configured or as the default shell on Windows. An attacker can supply a crafted payload containing special CMD syntax (e.g., "x) else if a==a (echo y") that, when escaped by the vulnerable library, still permits command injection through CMD's conditional statement parsing. Patches are available in v2.1.14 and v3.0.1.
Affected products
- Shescape Shescape before 2.1.14, 3.0.0
Timeline
- 2026-07-24: disclosed
- 2026-07-24: patched: v2.1.14 and v3.0.1 released