Is CVE-2026-73414 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73414 being exploited in the wild.

How severe is CVE-2026-73414?

Medium severity, with a CVSS score of 4, published 12 August 2026.

Which products and versions are affected?

shescape (npm) SEMVER:introduced=0,fixed=2.1.14.

Is there a fix for CVE-2026-73414?

Yes. shescape (npm): upgrade to 2.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73414 attacked?

It is attacked over the network.

Am I affected by CVE-2026-73414?

Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73414: Shescape shell injection via unescaped parentheses on Windows CMD

CVE-2026-73414 · Severity: medium · CVSS 4 · Published 2026-08-12

Shescape is a Node.js library used to safely escape command-line arguments before executing shell commands. On Windows systems using the CMD shell, the library fails to properly escape parentheses in user-supplied input, allowing attackers to inject arbitrary shell commands. An application using Shescape could be tricked into executing unintended commands, potentially leading to unauthorized access, data theft, or system compromise.

Technologies: shescape (npm). Vendors: npm.

Quick answers

Is CVE-2026-73414 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73414 being exploited in the wild.
How severe is CVE-2026-73414?: Medium severity, with a CVSS score of 4, published 12 August 2026.
Which products and versions are affected?: shescape (npm) SEMVER:introduced=0,fixed=2.1.14.
Is there a fix for CVE-2026-73414?: Yes. shescape (npm): upgrade to 2.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73414 attacked?: It is attacked over the network.
Am I affected by CVE-2026-73414?: Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

shescape (npm): upgrade to 2.1.14 or later
```
npm install shescape@2.1.14
```

Technical details

This is an OS command injection vulnerability (CWE-78) caused by improper neutralization of escape sequences (CWE-150) in Shescape's escape and escapeAll APIs when targeting the Windows CMD shell. The vulnerability exists in versions before 2.1.14 and in version 3.0.0 (fixed in 3.0.1). The root cause is that parentheses are not properly escaped, allowing attackers to break out of the intended command context. The attack requires the application to use Shescape with cmd.exe explicitly configured or as the default shell on Windows. An attacker can supply a crafted payload containing special CMD syntax (e.g., "x) else if a==a (echo y") that, when escaped by the vulnerable library, still permits command injection through CMD's conditional statement parsing. Patches are available in v2.1.14 and v3.0.1.

Affected products

Shescape Shescape before 2.1.14, 3.0.0

Identifiers

CVE-2026-73414
GHSA-w4hw-qcx7-56pr

Timeline

2026-07-24: disclosed
2026-07-24: patched: v2.1.14 and v3.0.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.