CVE-2026-73411

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73411
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73411.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73411
Aliases
Published
2026-08-12T19:33:02.860Z
Modified
2026-08-14T04:04:04.313141577Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Shescape: Home-directory disclosure in assignment context on Unix with Dash
Details

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, and interpolate the result into an assignment prefixed to a command. An attacker who controls the input can supply a value such as :~ to disclose the home-directory path and may change the location on which the command operates. This issue is fixed in versions 2.1.14 and 3.0.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73411.json",
    "cwe_ids": [
        "CWE-116",
        "CWE-200"
    ]
}
References

Affected packages

Git / github.com/ericcornelissen/shescape

Affected ranges

Type
GIT
Repo
https://github.com/ericcornelissen/shescape
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
68b9e590b7527fd9dbde91c450055059423942f6
Fixed
ae0faa7bd31331aec3f21c623ee69a50e6663454
Fixed
37303332910d456bf07bbf942c3ed98be156f365
Fixed
43d70b59d09bbe5c3fd02ef08b3a123e977ed9de
Fixed
b4b34c394e7f9da2775bb75381066b9a228c425f
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.14"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0
v0.2.0
v0.2.1
v0.3.0
v0.3.1
v0.4.0
v0.4.1
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.2.0
v1.2.1
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.5.0
v1.5.1
v1.5.10
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.5.7
v1.5.8
v1.5.9
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.1.1
v2.1.10
v2.1.11
v2.1.12
v2.1.13
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v3.*
v3.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73411.json"