CVE-2026-73412: Shescape Information Disclosure Vulnerability

CVE-2026-73412 Overview

CVE-2026-73412 affects Shescape, a shell escape library for JavaScript used to sanitize arguments passed to shell commands. The vulnerability impacts applications on Unix systems that configure Shescape to use Zsh, or that run on systems where Zsh is the default shell. In specific scenarios, an attacker can leverage Zsh home directory expansion and extended glob syntax through the escape and escapeAll functions to enumerate files and directories. The EXTENDED_GLOB and MAGIC_EQUAL_SUBST Zsh options amplify the issue. Depending on how the calling command processes output, this can leak additional sensitive information from the host filesystem. Maintainers addressed the flaw in versions 2.1.14 and 3.0.1.

Critical Impact
Attackers can enumerate filesystem paths and potentially exfiltrate sensitive directory contents through Shescape-protected commands running under Zsh.

Affected Products

Shescape versions prior to 2.1.14 (2.x branch)
Shescape versions prior to 3.0.1 (3.x branch)
Node.js applications on Unix hosts using Zsh as the configured or default shell

Discovery Timeline

2026-08-12 - CVE-2026-73412 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73412

Vulnerability Analysis

Shescape wraps untrusted arguments so they can be safely appended to shell command lines. The library relies on shell-specific escaping rules. When the configured shell is Zsh, certain metacharacters used for home directory expansion (~) and extended glob patterns are not fully neutralized before the argument reaches the shell. This falls under improper neutralization of special elements used in an OS command [CWE-78].

An attacker who controls a single argument passed through escape or escapeAll can craft input that Zsh expands into filesystem paths at execution time. Because the expansion occurs in the shell rather than the application, the resulting path list is substituted into the command line and passed to the invoked binary. When the target command echoes, logs, or otherwise processes the expanded arguments, the attacker learns which files and directories exist on the system.

Root Cause

The root cause is incomplete escaping of Zsh-specific expansion syntax within Shescape's internal argument composition logic. The pre-patch implementation processed only the first flag fragment returned by flagFn(arg) before falling back to escape logic, which could leave subsequent fragments unescaped when combined with Zsh options such as EXTENDED_GLOB and MAGIC_EQUAL_SUBST. Attacker-controlled tilde expressions and glob qualifiers survived escaping and were interpreted by Zsh at command invocation.

Attack Vector

Exploitation requires an application to invoke a shell command using Zsh with an argument that originates from untrusted input and is passed through Shescape's escape or escapeAll. The attacker supplies input containing home directory prefixes such as ~user or glob qualifiers such as *(N) and =(...). Zsh expands these at execution time, and the target command receives the expanded filesystem paths.

javascript

// Security patch in src/internal/compose.js - Improve overall escaping (#2649)
  return (arg) => {
-    let [preFlag, , ...rest] = flagFn(arg);
-    while (rest.length > 0 && escapeFn(preFlag) === "") {
-      arg = rest.join("");
-      [preFlag, , ...rest] = rest;
+    const fragments = flagFn(arg);
+
+    let idx = 0;
+    for (; idx < fragments.length - 2; idx += 2) {
+      const escapedFragment = escapeFn(fragments[idx]);
+      if (escapedFragment !== "") {
+        break;
+      }
     }

+    arg = fragments.slice(idx).join("");
     return escape(arg);
  };
}
// Source: https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de

The patch replaces the destructuring loop with an index-based scan across all fragments returned by flagFn. Every fragment is evaluated by escapeFn until a non-empty escaped result is found, ensuring that subsequent fragments cannot bypass escaping. The same fix is applied in commit b4b34c3 for the 3.x release line.

Detection Methods for CVE-2026-73412

Indicators of Compromise

Shell command logs containing unexpected expanded paths such as /home/*/, /root/, or user home directory listings appearing in arguments after Shescape processing
Application logs showing input strings containing ~, ~user, *(N), or =(...) patterns forwarded to child process invocations
Outbound responses or error messages leaking filesystem paths from the server

Detection Strategies

Inventory Node.js dependency trees for shescape at versions below 2.1.14 or 3.0.1 using software composition analysis tools
Instrument process execution telemetry to alert when child processes spawned by Node.js runtimes receive arguments containing tilde expressions or Zsh glob qualifiers
Review application input validation to confirm whether untrusted data reaches escape or escapeAll before shell execution under Zsh

Monitoring Recommendations

Log full argv for child processes on hosts running affected Shescape versions and forward the telemetry to a centralized analytics platform
Alert on responses that include filesystem paths not expected by the application's schema
Monitor package manager events for installations or downgrades of shescape across build and runtime environments

How to Mitigate CVE-2026-73412

Immediate Actions Required

Upgrade shescape to version 2.1.14 on the 2.x branch or 3.0.1 on the 3.x branch
Audit all call sites of escape and escapeAll where the configured shell is Zsh or the host default shell is Zsh
Restrict untrusted input from being passed as arguments to shell commands until the upgrade is deployed

Patch Information

The fix is delivered in Shescape v2.1.14 and Shescape v3.0.1. The corrective changes are tracked in Pull Request #2649 and Pull Request #2651, with additional context in GitHub Security Advisory GHSA-6v4m-fw66-8r4x.

Workarounds

Configure Shescape to target a shell other than Zsh (for example, bash or sh) if application requirements permit
Invoke child processes without a shell wrapper by passing arguments as an array to child_process.execFile or spawn, avoiding shell interpretation altogether
Disable the Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST in the shell environment used by the application

bash

# Configuration example: upgrade to the patched release
npm install shescape@3.0.1
# or for the 2.x branch
npm install shescape@2.1.14

# Verify the installed version
npm ls shescape