CVE-2026-73412

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73412
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73412.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73412
Aliases
Published
2026-08-12T19:38:41.860Z
Modified
2026-08-15T11:31:22.941961450Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Shescape: Path disclosure on Unix with Zsh
Details

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUAL_SUBST exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used to leak more information. This issue is fixed in versions 2.1.14 and 3.0.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73412.json",
    "cwe_ids": [
        "CWE-155",
        "CWE-78"
    ]
}
References

Affected packages

Git / github.com/ericcornelissen/shescape

Affected ranges

Type
GIT
Repo
https://github.com/ericcornelissen/shescape
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
68b9e590b7527fd9dbde91c450055059423942f6
Fixed
ae0faa7bd31331aec3f21c623ee69a50e6663454
Fixed
37303332910d456bf07bbf942c3ed98be156f365
Fixed
43d70b59d09bbe5c3fd02ef08b3a123e977ed9de
Fixed
b4b34c394e7f9da2775bb75381066b9a228c425f
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.14"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0
v0.2.0
v0.2.1
v0.3.0
v0.3.1
v0.4.0
v0.4.1
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.2.0
v1.2.1
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.5.0
v1.5.1
v1.5.10
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.5.7
v1.5.8
v1.5.9
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.1.1
v2.1.10
v2.1.11
v2.1.12
v2.1.13
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v3.*
v3.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73412.json"