# CVE-2026-73414: Shescape shell injection via unescaped parentheses on Windows CMD

Source: https://junglewise.ai/threats/cve-2026-73414-shescape-shell-injection-via-unescaped-parentheses-on-windows-cmd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73414 · Severity: medium · CVSS 4 · Published 2026-08-12

Shescape is a Node.js library used to safely escape command-line arguments before executing shell commands. On Windows systems using the CMD shell, the library fails to properly escape parentheses in user-supplied input, allowing attackers to inject arbitrary shell commands. An application using Shescape could be tricked into executing unintended commands, potentially leading to unauthorized access, data theft, or system compromise.

Technologies: [shescape (npm)](https://junglewise.ai/threats/technologies/shescape). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-73414 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73414 being exploited in the wild.

**How severe is CVE-2026-73414?** Medium severity, with a CVSS score of 4, published 12 August 2026.

**Which products and versions are affected?** shescape (npm) SEMVER:introduced=0,fixed=2.1.14.

**Is there a fix for CVE-2026-73414?** Yes. shescape (npm): upgrade to 2.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73414 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73414?** Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- shescape (npm): upgrade to 2.1.14 or later

  ```sh
  npm install shescape@2.1.14
  ```


## Technical details

This is an OS command injection vulnerability (CWE-78) caused by improper neutralization of escape sequences (CWE-150) in Shescape's escape and escapeAll APIs when targeting the Windows CMD shell. The vulnerability exists in versions before 2.1.14 and in version 3.0.0 (fixed in 3.0.1). The root cause is that parentheses are not properly escaped, allowing attackers to break out of the intended command context. The attack requires the application to use Shescape with cmd.exe explicitly configured or as the default shell on Windows. An attacker can supply a crafted payload containing special CMD syntax (e.g., "x) else if a==a (echo y") that, when escaped by the vulnerable library, still permits command injection through CMD's conditional statement parsing. Patches are available in v2.1.14 and v3.0.1.

## Affected products

- Shescape Shescape before 2.1.14, 3.0.0

## Identifiers

- CVE-2026-73414
- GHSA-w4hw-qcx7-56pr

## Timeline

- 2026-07-24: disclosed
- 2026-07-24: patched: v2.1.14 and v3.0.1 released

## References

- [https://github.com/ericcornelissen/shescape/security/advisories/GHSA-w4hw-qcx7-56pr](https://github.com/ericcornelissen/shescape/security/advisories/GHSA-w4hw-qcx7-56pr)
- [https://github.com/ericcornelissen/shescape/pull/2649](https://github.com/ericcornelissen/shescape/pull/2649)

## Related threats

- [Shescape quadratic-time denial of service in flag-protection](https://junglewise.ai/threats/cve-2026-73413-shescape-quadratic-time-denial-of-service-in-flag-protection)
- [Shescape path disclosure on Unix with Zsh](https://junglewise.ai/threats/cve-2026-73412-shescape-path-disclosure-on-unix-with-zsh)
- [Shescape home-directory disclosure in Dash shell assignment](https://junglewise.ai/threats/cve-2026-73411-shescape-home-directory-disclosure-in-dash-shell-assignment)
- [Shescape escape() bracket glob expansion bypass on Bash, BusyBox, and Dash](https://junglewise.ai/threats/cve-2026-32094-shescape-escape-bracket-glob-expansion-bypass-on-bash-busybox-and)
- [Shescape shell misidentification via symlink chains](https://junglewise.ai/threats/cve-2026-30916-shescape-shell-misidentification-via-symlink-chains)