CVE-2026-73411: Shescape Information Disclosure Vulnerability

CVE-2026-73411 Overview

CVE-2026-73411 affects Shescape, a shell escape library for JavaScript. Prior to versions 2.1.14 and 3.0.1, the getEscapeFunction in src/internal/unix/dash.js fails to escape the tilde character (~) when it appears after : or =. The flaw triggers when applications use the escape or escapeAll APIs on Unix with the shell set to dash, or with the shell set to true when Dash is the default, and interpolate the result into an assignment prefixed to a command. An attacker who controls input can supply a value such as :~ to disclose the home-directory path or change the location on which the command operates. This issue is fixed in versions 2.1.14 and 3.0.1.

Critical Impact
Attackers controlling input can leak the home-directory path and alter command execution context through unescaped tilde expansion in Dash assignments.

Affected Products

Shescape versions prior to 2.1.14 (2.x branch)
Shescape versions prior to 3.0.1 (3.x branch)
Applications using escape or escapeAll APIs on Unix with Dash shell

Discovery Timeline

2026-08-12 - CVE-2026-73411 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73411

Vulnerability Analysis

The vulnerability resides in Shescape's Dash shell escaping logic in src/internal/unix/dash.js. The getEscapeFunction implementation does not handle tilde (~) expansion when it appears immediately after : or = characters. Dash performs tilde expansion in these positions during variable assignment parsing, which allows a caller-controlled string like :~ to expand into the user's home directory path.

When an application uses Shescape to sanitize an attacker-controlled value and interpolates the escaped result into an assignment such as VAR=<escaped> that is prefixed to a command, tilde expansion still occurs. This lets the attacker disclose the home-directory path or redirect the command to operate on unintended filesystem locations.

Root Cause

The root cause is improper output neutralization for the downstream shell interpreter ([CWE-116]). The Dash escape routine did not treat ~ as a metacharacter in the specific positional context following : or =, leaving a gap in the character class the escape function protects against.

Attack Vector

Exploitation requires an application that passes attacker-controlled input through Shescape's escape or escapeAll API on Unix with Dash as the target shell, then places the escaped value into a command-line assignment prefix. The attacker supplies a payload beginning with :~ (or a similar :~user or =~ pattern) so that Dash's tilde expansion resolves to a home-directory path before the command runs.

javascript

// Patch excerpt: src/internal/compose.js — improved fragment handling
// Source: https://github.com/ericcornelissen/shescape/commit/b4b34c394e7f9da2775bb75381066b9a228c425f

  return (arg) => {
-    let [preFlag, , ...rest] = flagFn(arg);
-    while (rest.length > 0 && escapeFn(preFlag) === "") {
-      arg = rest.join("");
-      [preFlag, , ...rest] = rest;
+    const fragments = flagFn(arg);
+
+    let idx = 0;
+    for (; idx < fragments.length - 2; idx += 2) {
+      const escapedFragment = escapeFn(fragments[idx]);
+      if (escapedFragment !== "") {
+        break;
+      }
     }

+    arg = fragments.slice(idx).join("");
     return escape(arg);
   };
 }

Source: GitHub Commit b4b34c3

Detection Methods for CVE-2026-73411

Indicators of Compromise

Command execution logs containing unexpected absolute paths resolving to user home directories after variable assignments (e.g., VAR=/home/<user>...).
Application inputs containing :~, =~, or :~user patterns forwarded to shell invocations.
Access to files in home directories that the application does not normally reference.

Detection Strategies

Perform a dependency inventory scan for shescape versions less than 2.1.14 or 3.0.0 through 3.0.0 in Node.js projects.
Review code paths that call escape or escapeAll and interpolate the return value into VAR=<value> command assignment prefixes.
Add input-validation logging around API endpoints that accept free-form strings later passed to shell execution.

Monitoring Recommendations

Monitor process execution telemetry for dash, sh, or /bin/sh invocations where assignment values contain expanded home-directory paths.
Alert on child processes spawned by Node.js runtime whose arguments include ~-expanded paths inconsistent with expected application behavior.
Track outbound file reads from home directories initiated by service accounts running affected Node.js applications.

How to Mitigate CVE-2026-73411

Immediate Actions Required

Upgrade shescape to version 2.1.14 on the 2.x branch or 3.0.1 on the 3.x branch.
Audit application code that invokes escape or escapeAll and interpolates results into shell assignment prefixes.
Where possible, avoid shelling out entirely and use child_process.execFile or spawn with argument arrays instead of exec.

Patch Information

Maintainers fixed the issue in Shescape 2.1.14 and 3.0.1. Details are published in the GitHub Security Advisory GHSA-q53c-4prm-w95q, with fixes landed in Pull Request #2649 and Pull Request #2651. Release notes are available for v2.1.14 and v3.0.1.

Workarounds

Reject or strip leading ~, :~, and =~ sequences from user input before passing values to Shescape.
Switch the target shell away from Dash if application requirements allow, and validate that the replacement shell is not similarly affected.
Move shell-prefixed environment assignments into explicit env objects passed to child_process.spawn to avoid interpolation into the command string.

bash

# Update Shescape to a fixed version
npm install shescape@^3.0.1
# or, for the 2.x branch
npm install shescape@^2.1.14

# Verify the installed version
npm ls shescape