CVE-2026-73414: Shescape JavaScript Library RCE Vulnerability

CVE-2026-73414 Overview

CVE-2026-73414 is a command injection vulnerability [CWE-78] in Shescape, a shell escape library for JavaScript. The flaw resides in the getEscapeFunction in src/internal/win/cmd.js, which fails to escape the ( and ) characters. Applications using the escape or escapeAll APIs on Windows with the shell set to cmd.exe, or with shell set to true when CMD is the default, are affected. An attacker who controls an argument can break out of a parenthesized CMD construct and inject arbitrary shell syntax. This results in arbitrary command execution depending on the original command structure. The issue is fixed in versions 2.1.14 and 3.0.1.

Critical Impact
Attacker-controlled input can inject arbitrary Windows CMD commands into applications relying on Shescape for sanitization, leading to remote code execution in server-side JavaScript environments.

Affected Products

Shescape versions prior to 2.1.14 (2.x branch)
Shescape versions prior to 3.0.1 (3.x branch)
JavaScript applications on Windows invoking cmd.exe through Shescape's escape or escapeAll APIs

Discovery Timeline

2026-08-12 - CVE-2026-73414 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73414

Vulnerability Analysis

Shescape is designed to sanitize arguments passed to shell commands, preventing injection attacks. The library's Windows CMD escape function omitted the parenthesis characters from its escape set. On Windows CMD, parentheses have syntactic meaning when used to group commands, such as in (command1 & command2) constructs. When an application wraps user input inside such a grouped construct and relies on Shescape to sanitize the argument, an attacker supplying a ) character can prematurely terminate the group. The remainder of the attacker-supplied string is then interpreted as CMD syntax rather than as an argument value.

Root Cause

The root cause lies in getEscapeFunction inside src/internal/win/cmd.js. The escaping logic did not treat ( and ) as metacharacters requiring quotation or backslash-escaping. This omission violates the library's contract of producing safe arguments for cmd.exe. The upstream fix also revised argument fragment composition logic in src/internal/compose.js to ensure escaped fragments are correctly assembled.

Attack Vector

Exploitation requires an application on Windows that passes attacker-controlled input through Shescape's escape or escapeAll API to a cmd.exe invocation. The parent command must include a parenthesized construct that the untrusted argument appears inside. The attacker submits input containing ) followed by arbitrary CMD syntax such as & calc.exe. CMD parses the closing parenthesis as the end of the group and executes the injected command chain with the privileges of the host process.

javascript

// Security patch in src/internal/compose.js - PR #2649 / #2651
// Improves argument fragment composition to ensure escaping is applied correctly
  return (arg) => {
-    let [preFlag, , ...rest] = flagFn(arg);
-    while (rest.length > 0 && escapeFn(preFlag) === "") {
-      arg = rest.join("");
-      [preFlag, , ...rest] = rest;
+    const fragments = flagFn(arg);
+
+    let idx = 0;
+    for (; idx < fragments.length - 2; idx += 2) {
+      const escapedFragment = escapeFn(fragments[idx]);
+      if (escapedFragment !== "") {
+        break;
+      }
     }

+    arg = fragments.slice(idx).join("");
    return escape(arg);
  };
}
// Source: https://github.com/ericcornelissen/shescape/commit/43d70b59d09bbe5c3fd02ef08b3a123e977ed9de

Detection Methods for CVE-2026-73414

Indicators of Compromise

Unexpected child processes spawned by Node.js processes on Windows, particularly cmd.exe invocations with unusual argument structures containing ), &, |, or ^.
Application logs showing HTTP request parameters or API inputs containing raw parenthesis characters that reach shell command construction paths.
Presence of Shescape versions below 2.1.14 or below 3.0.1 in package-lock.json or yarn.lock on Windows hosts.

Detection Strategies

Perform software composition analysis (SCA) across Node.js projects to identify vulnerable Shescape versions in the dependency tree, including transitive dependencies.
Monitor Windows endpoints for node.exe or Electron processes spawning cmd.exe with command lines containing suspicious grouping operators after user-influenced tokens.
Instrument application-layer logging to record raw input passed to any function that eventually calls child_process.exec with shell: true.

Monitoring Recommendations

Enable process creation auditing on Windows servers running Node.js applications and forward Sysmon Event ID 1 to a centralized log platform.
Alert on cmd.exe child processes whose parent is a Node.js runtime and whose command line includes reconnaissance binaries such as whoami.exe, net.exe, or powershell.exe.
Track outbound network connections initiated by shells parented to server-side JavaScript processes.

How to Mitigate CVE-2026-73414

Immediate Actions Required

Upgrade Shescape to 2.1.14 or 3.0.1 immediately across all Windows deployments using npm install shescape@^2.1.14 or npm install shescape@^3.0.1.
Audit application code for calls to escape and escapeAll on Windows targets and identify any parent commands that use parenthesized CMD constructs.
Rebuild and redeploy container images and serverless bundles that ship the vulnerable Shescape versions.

Patch Information

The upstream fixes are delivered in GitHub Release v2.1.14 and GitHub Release v3.0.1. Technical details are documented in GitHub Security Advisory GHSA-w4hw-qcx7-56pr. The corrective commits are 43d70b5 and b4b34c3, delivered via PR #2649 and PR #2651.

Workarounds

Avoid using cmd.exe as the shell on Windows; specify PowerShell explicitly, which Shescape escapes correctly for the vulnerable versions.
Refactor command construction to avoid wrapping untrusted arguments inside parenthesized CMD groups until the patched version is deployed.
Where possible, invoke child processes with shell: false and pass arguments as an array so CMD parsing is bypassed entirely.

bash

# Upgrade the vulnerable dependency
npm install shescape@^3.0.1
# or, for the 2.x branch
npm install shescape@^2.1.14

# Verify installed version
npm ls shescape